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PREFACE 


This  report  describes  a  study  of  the  feasibility  of  an  automated  system  that 
would  assist  in  the  detection  and  management  of  in-flight  fire  or  smoke 
incidents.  The  system  is  referred  to  as:  Aircraft  Command  in  Emergency 
Situations,  or  ACES.  It  is  intended  to  provide  support  to  the  flight  crew;  it 
does  not  preempt  any  crew  function.  The  ACES  study  was  conducted  by 
Dunlap  and  Associates,  Inc.,  under  contract  to  the  U.S.  Department  of 
Transportation;  the  Federal  Aviation  Administration  (FAA)  Technical  Center  in 
Atlantic  City,  NJ,  administered  the  contract  and  provided  technical  oversight 
and  guidance. 

The  Dunlap  and  Associates,  Inc.,  staff  consisted  of  Richard  D.  Blomberg, 
Edward  W.  Bishop  and  John  W.  Hamilton.  Mr.  Blomberg,  the  President 
of  Dunlap  and  Associates,  was  the  principal  investigator.  This  staff  was 
augmented  by  two  special  consultants.  In  addition,  many  people  in  the  air 
transport  industry  volunteered  their  time  and  special  expertise  in  support  of 
the  study.  However,  the  responsibility  for  the  completeness  and  the  quality  of 
the  study  rests  solely  with  the  Dunlap  staff. 

Dr.  Thor  Eklund  was  assigned  by  FAA  as  Technical  Officer  for  this  study  and 
was  assisted  in  this  role  by  Mr.  Allan  Abramowitz.  They  both  provided  very 
valuable  guidance  as  to  the  conduct  of  the  study  as  well  as  a  substantial 
background  of  information  about  in-flight  fires,  relevant  research  and  FAA 
activities  and  interests.  The  quality  of  the  study  was  greatly  enhanced  by 
their  dedicated  contributions  and  helpful  reviews. 

Mr.  Richard  L.P.  Custer,  an  Associate  Professor  of  Fire  Protection  and 
Mechanical  Engineering  at  Worcester  Polytechnic  Institute,  was  a  consultant  to 
this  study  from  its  inception.  He  helped  in  planning  and  in  all  subsequent 
phases  of  the  study;  he  authored  those  parts  of  the  report  which  concern  fire 
propagation  and  sensor  technology. 

Mr.  Norman  R.  Parmet,  who  retired  as  Vice  President  of  Engineering  of  TWA, 
was  a  consultant  throughout  the  study.  Mr.  Parmet  is  an  airline  industry 
consultant  and  participates  in  aircraft  accident  investigations.  He  is  also  Vice 
Chairman  of  the  NASA  Aerospace  Safety  Advisory  Panel.  He  provided  special 
help  with  regard  to  air  crew  functions  and  operations,  and  provided  guidance 
for  the  overall  conduct  of  the  study.  He  was  instrumental  in  gaining  airline 
cooperation. 

The  cooperation  of  several  people  in  the  air  transport  industry  was  very 
generously  given.  Many  of  these  were  in  direct  contact  with  the  study  staff 
but  they  were  also  supported  by  others  in  each  organization.  In  order  to  avoid 
any  inadvertent  omission  of  any  of  these  advisors,  we  will  list  below  only  the 
organizations  with  which  they  are  affiliated.  The  contribution  of  each  one  was 
essential  and  valuable  to  the  study.  A  very  grateful  acknowledgment  is 
extended  to  these  organizations  and  their  staffs: 

o  Aeronautical  Radio,  Inc.  o  Douglas  Aircraft  Company 

o  Airbus  Industrie  o  National  Transportation  Safety  Board 

o  American  Airlines  o  Trans  World  Airlines 

o  Boeing  Commercial  Airplane  o  United  Airlines 

Company 
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EXECUTIVE  SUMMARY 


This  study  was  performed  by  Dunlap  and  Associates,  Inc.,  under  Contract 
DTFA03-87-C-00020  for  the  Federal  Aviation  Administration  (FAA)  Technical 
Center.  It  had  its  origin  in  the  Center's  concern  for  the  detection  and  control 
of  in-flight  fire  and  smoke  incidents.  The  purpose  of  the  study  was  to  conduct 
a  technology  assessment  to  determine  whether  the  feasibility  exists  for  FAA  to 
support  development  of  a  computer-based  cockpit  system  for  assisting  aircraft 
command  in  emergency  (in-flight  fire/smoke)  situations.  This  system,  which 
would  supplement  and  facilitate  the  crew  response,  is  referred  to  as  ACES. 
The  technology  assessment  of  ACES  was  defined  to  include  only  in-flight  fire 
and  smoke  incidents  not  originating  in  an  engine  or  flight  control  surfaces.  It 
was  further  limited  to  commercial  transport  aircraft  in  regular  (non-commuter) 
airline  service.  The  application  of  ACES  was  to  be  considered  only  for  new 
aircraft,  not  for  retrofit. 

This  study  was  designed  around  the  development  and  analysis  of  a  set  of 
scenarios  which  describe  in-flight  fire  and  smoke  incidents  that  had  actually 
occurred  or  that  could  reasonably  be  expected  to  occur.  Thirteen  such 
scenarios  were  produced:  four  based  on  actual  events  which  had  been 
investigated  in  detail  and  nine  based  on  incident  reports  or  on  potential 
incidents  of  special  concern  to  the  industry.  The  scenarios  were  written 
without  identification  of  aircraft  model,  and  no  company  or  individual  names 
were  used.  For  those  based  on  actual  events,  the  locale  was  changed  to 
further  assure  anonymity.  The  13  scenarios  that  were  developed  range  from  a 
catastrophe  in  which  the  more  than  300  persons  on  board  perished  and  the 
aircraft  was  completely  destroyed  to  a  minor  overheating  of  a  light  ballast. 
False  alarms  are  also  included.  These  13  scenarios,  then,  are  a  realistic 
representation  of  the  universe  of  events  to  which  a  flight  crew,  using  an  ACES 
system,  could  be  expected  to  respond. 

The  technology  to  support  an  ACES  system  was  examined  in  two  broad  areas: 
sensor  technology  (existing  or  projected)  to  provide  the  information  required  to 
cope  with  the  anticipated  incidents;  and  computer  and  display  technology  by 
which  the  ACES  interface  with  the  cockpit  crew  would  be  implemented.  In 
addition,  the  human  factors  and  crew  workload  involved  in  reacting  to  and 
using  the  ACES  system  were  assessed. 

A  baseline  for  feasibility  assessment  was  established  by  analyzing  the  problem 
faced  by  the  crew  in  each  scenario  and  describing  the  crew  response  under 
current  procedures.  This  was  done  on  a  timeline  showing  the  evolution  of  the 
incident  as  well  as  the  crew  responses  and  effects.  This  analysis  was  carefully 
reviewed  to  ensure  that  the  baseline  accurately  reflected  what  had  actually 
occurred  or  what  would  have  occurred  in  the  case  of  the  adapted  scenarios. 

In  parallel,  a  hypothetical  ACES  system  was  postulated.  It  includes  the  sensing 
of  both  smoke  and  heat  as  well  as  the  determination  of  rate  and  duration  of 
change  in  both.  It  provides  monitoring  and  adjustment  of  its  own  system 
sensitivity  and  operational  status.  The  ACES  interface  with  the  crew  ;s 
incorporated  into  the  existing  master  warning  concept,  and  appropriate  advisory 
emergency  procedure  information  is  "forced"  to  a  cockpit  display.  This 


ix 


conceptual  system  also  has  access  to  "circumstantial  evidence"  such  as  electrical 
and  hydraulic  system  status.  All  of  these  features  are  within  the  current  state 
of  each  of  the  technologies  and  no  development  of  new  technology  is  required. 

Each  of  the  scenarios  was  then  analyzed  a  second  time  assuming  that  the  ACES 
concept  had  been  available  and  applied. 

The  outcomes  of  this  study  are  summarized  in  the  following  conclusions: 

1.  An  ACES,  as  conceptualized,  is  well  within  the  current  (or  very  near 
future)  state  of  sensor,  computer  and  display  technology. 

2.  Appropriate  and  adequate  human  participation  in  the  ACES  concept  is  both 
feasible  and  practical.  Specific  human  factors  design  and  training  issues  will 
have  to  be  addressed,  but  these  present  no  impediment  to  ACES  implementation. 

3.  The  analysis  of  current  operations  suggests  that  evaluation  and 
interpretation  of  current  alarms  and  indications  (such  as  smoke  source)  by  the 
crew  is  extremely  time  consuming,  often  erroneous  and  at  odds  with  the  only 
essential  response,  which  is  to  land  the  aircraft  as  quickly  as  possible. 

4.  The  crew  response  to  the  current  system,  including  evaluation  and 
interpretation,  tends  to  increase  workload  which  is  further  exacerbated  when 
the  crew  persists  in  erroneous  conclusions  (as  has  often  happened). 

5.  Crew  workload  is  not  negatively  affected  by  the  requirements  of  the  ACES 
concept . 

6.  A  common  characteristic  of  crew  responses  in  the  current  situation  is  a 
reluctance  to  accept  smoke /fire  warnings.  Presumably,  this  results  from 
experience  with  unreliable  sensors  and  perhaps  from  an  unwillingness  to 
acknowledge  a  potentially  catastrophic  event.  This  represents  a  human  factor 
to  be  considered  in  ACES  implementation. 

7.  In  virtually  every  ACES  analysis,  the  scenario  would  have  been  resolved 
more  quickly  and  the  outcome  would  have  been  less  catastrophic  had  the 
conceptual  system  been  applied. 

8.  ACES  implementation  from  a  technological  viewpoint  is  essentially  a 
continuation  of  current  development  activity.  Operationally,  this  implementation 
will  require  special  attention  to  system  integration  and  crew  attitude  toward  and 
acceptance  of  the  ACES  concept. 
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INTRODUCTION 


This  is  the  final  report  of  contract  number  DTFA03-87-C-G0020  between  the 
U.S.  Department  of  Transportation,  Federal  Aviation  Administration  (FAA) 
Technical  Center  and  Dunlap  and  Associates,  Inc.  The  study  reported  herein 
is  entitled  "Technology  Assessment  for  Aircraft  Command  in  Emergency 
Situations . " 

OBJECTIVES. 

Recent  developments  in  aviation  have  provided  both  new  opportunities  and  new 
requirements  in  various  aspects  of  flight  management.  These  developments  have 
potential  additional  impact  on  detection  and  control  of  hazards  arising  from  in¬ 
flight  fire  and  smoke  incidents.  The  purpose  of  this  study  was  to  conduct  a 
technology  assessment  to  determine  whether  the  feasibility  exists  for  the  FAA  to 
support  the  development  of  a  computer-based  cockpit  system  to  assist  aircraft 
command  in  emergency  situations  (ACES).  The  technology  assessment  was  to 
address  the  state-of-the-art  of  in-flight  fire  sensing  and  management,  and  of 
cockpit  computer  and  display  technology  for  interfacing  with  the  aircrew 
through  diagnostic  and  prescriptive  information. 

The  boundaries  of  the  ACES  feasibility  study  were  defined  to  include  only: 

1.  In-flight  fire  and  smoke  incidents  exclusive  of  lifting  and  control  surfaces 
and  propulsion  plants; 

2.  Commercial,  regular  airline  (as  opposed  to  commuter)  transport  aircraft; 

3.  New  aircraft  designs  rather  than  retrofits- to  existing  aircraft. 

In  order  to  achieve  the  overall  purpose  of  the  study,  the  following  four 
questions  had  to  be  answered: 

1.  What  information  is  needed  to  locate  and  monitor  fire  and  smoke  sources? 

2.  Is  the  sensing  capability  available  or  attainable? 

3.  What  courses  of  action  can  be  employed  in  reaction  to  the  sensed 
information? 

4.  Within  constraints  of  cockpit  technology  anticipated  for  future  commercial 
transport  aircraft,  can  this  information  be  computerized  and  retrieved  in  a 
fail-safe  manner? 

The  pursuit  of  answers  to  these  questions  led  directly  to  the  major  tasks  of  the 
study.  These  were: 

Problem  analysis  and  fire  scenario  development.  The  contract  specified 
that  10  scenarios,  primarily  concerned  with  fires  of  an  inaccessible  nature,  were 
to  be  developed.  As  work  progressed,  it  was  clear  that  more  than  10  would  be 
needed  to  describe  the  full  range  of  actual  fires  and  false  alarm  events  with 
which  an  ACES  would  have  to  deal.  The  final  set  of  13  scenarios  were  used  to 
guide  the  remainder  of  the  work  effort. 
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Sensor  identification  and  analysis.  The  ability  of  existing  sensors  to  cope 
with  the  fire /smoke  incidents  described  in  the  scenarios  was  assessed.  In 
addition,  the  applicability  of  emerging  sensor  technology  to  the  defined 
problems  was  also  examined.  The  objective  of  this  effort  was  to  identify  the 
means  for  sensing  valid  information  which  would  be  accurate,  reliable  and 
consistent  with  the  mission  of  an  ACES. 

Cockpit  resource  analysis.  The  ability  of  existing  and  potential  cockpit 
computer,  display  and  warning  systems  to  handle  information  related  to  the 
management  of  fires  was  studied. 

Crew  interface  analysis .  Crew  human  factors,  particularly  workload, 
under  the  demands  of  the  13  scenarios  was  assessed  to  determine  the  ability  of 
the  pilots  to  use  effectively  the  information  provided  by  an  ACES  system. 

Feasibility  assessment.  The  information  from  all  of  the  various  analyses 
was  integrated  using  appropriate  methodologies  in  order  to  reach  conclusions 
concerning  ACES  feasibility. 

The  specific  approach  to  each  of  these  tasks  is  covered  in  detail  in  the  next 
section  of  this  report.  This  is  followed  by  a  description  of  a  hypothetical  ACES 
system.  Following  that,  each  of  the  13  scenarios  is  presented  including  the 
application  of  the  ACES  concept  as  a  test  of  feasibility.  The  report  closes  with 
conclusions  concerning  the  feasibility,  benefits  and  possible  uses  of  an  ACES 
system  designed  in  accordance  with  the  proposed  concepts. 

BACKGROUND. 

THE  PROBLEM.  There  are  few  events  in  aviation  which  conjure  up  more  fear 
and  feelings  of  helplessness  than  in-flight  fires.  The  notion  of  being  in 
command  of  a  commercial  jet  transport  carrying  over  350  people  at  35,000  feet 
over  the  Atlantic  which  experiences  a  fire  in  a  hidden  space  is  universally 
chilling  to  airmen.  Obviously,  the  prevention  of  such  fires  is  of  paramount 
importance  to  the  safety  of  civil  aviation.  The  air  transport  industry  as  well  as 
regulatory  agencies  have  focused  a  substantial  effort  on  fire  prevention,  and 
the  design  of  modern  transports  does  much  to  minimize  in-flight  fire  hazards. 
As  a  result,  the  incidence  of  in-flight  fire  and  smoke  in  the  cabins  of  jet 
aircraft  is  quite  small  relative  to  overall  flight  operations  (Lorengo  and  Porter, 
1986). 

In  spite  of  the  best  prevention  efforts,  in-flight  fires  do  occur.  Hence,  ways 
to  manage  and  control  them  and  reduce  their  severity,  particularly  with  respect 
to  loss  of  life,  are  warranted.  These  efforts  can  productively  focus  on  the 
detection  of  fires  and  tneir  containment  or  suppression.  Coupled  with  the  need 
for  rapid  detection  of  real  fire  or  smoke  events  is  the  need  to  eliminate  false 
alarms.  Simply,  once  the  crew  of  an  aircraft  in  flight  declares  an  emergency 
and  takes  appropriate  actions  up  to  and  including  a  diversion  and  emergency 
evacuation,  risk  to  the  persons  on  board  increases.  There  are  also  obvious 
negative  impacts  to  an  air  carrier  from  emergency  evacuations ,  especially  if 
they  prove  to  be  false  alarms.  It  is  almost  impossible  to  evacuate  a  transport 
aircraft  without  some  injuries  to  passengers  arising  from  the  escape  process. 

There  is  a  great  potential  for  disaster  whenever  an  in-flight  fire  occurs. 
Therefore,  there  is  little  interest  among  airlines,  pilots  or  regulatory  agencies 
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in  a  system  which  would  deal  with  a  fire  during  flight  and  allow  the  plane  to 
continue  to  its  planned  destination.  The  strong  consensus  is  that  the  only 
viable  countermeasure  to  a  confirmed  in-flight  fire  is  an  immediate  decision  to 
land  at  the  nearest  suitable  airport.  Thus,  the  ACES  concept  incorporates  this 
response  as  its  primary,  inflexible  parameter.  Other  practical  countermeasures 
or  suppression  activities  are  included  as  secondary  parameters. 

In  order  to  achieve  the  desired  response,  an  acceptable  ACES  would  have  to 
concentrate  on  the  rapid  detection  of  fire  and  smoke  events,  the  determination 
of  their  severity,  and  the  discrimination  of  real  events  from  false  alarms.  This 
would  permit  the  crew  to  minimize  the  time  between  the  onset  of  a  real  event 
and  the  time  the  aircraft  is  on  the  ground  at  a  suitable  airport.  It  would  also 
provide  the  maximum  amount  of  time  for  analyzing  and  choosing  a  suitable  field. 

The  concern  with  in-flight  fires  in  the  U.S.  commercial  fleet  focuses  primarily 
on  their  potential  for  catastrophic  events.  Most  of  the  reported  in-flight  fires 
in  the  FAA  data  bases  are  relatively  minor  and  do  not  even  involve  a  change  in 
flight  plan.  Lorengo  and  Porter  (1986)  identify  1,274  "cabin /cockpit  in-flight 
fire  and  smoke  incidents"  for  the  years  1979  through  1985.  Only  290  of  these 
involved  an  unscheduled  landing  or  emergency  descent.  Over  the  same  time 
period,  however,  there  were  two  major  in-flight  fires  with  resultant  fatalities. 
In  1980,  a  Saudi  Lockheed  L-1011  Tristar  experienced  an  in-flight  fire  and, 
although  it  managed  to  return  and  land  at  Riyadh,  its  departure  point,  all  301 
people  on  board  died.  In  1983,  an  Air  Canada  DC-9  en  route  to  Toronto, 
Canada,  from  Dallas,  Texas,  caught  fire  and  eventually  diverted  to  the  Greater 
Cincinnati  International  Airport.  Twenty-three  of  the  46  on  board  perished. 

The  potential  dangers  of  in-flight  fires  are  compounded  by  the  presence  of 
combustible  material  in  several  areas  of  a  modern  transport  which  are  essentially 
inaccessible  during  flight.  Large  underfloor  cargo  con  nartments ,  miles  of 
wiring  and  hydraulic  lines  buried  in  cheek,  underfloor  and  attic  spaces  and 
extensive  electronic  racks  in  avionics  bays  are  all  areas  in  which  in-flight  fires 
may  start  and  burn  undetected  until  they  are  sufficiently  large  as  to  present  a 
serious  threat  to  aircraft  systems  and  occupants.  These  types  of  fires 
represent  a  greater  concern  than  those  which  begin  in  the  cabin  itself  as  a 
result  of,  for  example,  smoking,  overheated  light  ballasts  or  galley  accidents. 
Accessible  cabin  areas  are  typically  well  populated  by  human  "sensors"  who 
provide  early  detection.  Such  fires  can  then  be  dealt  with  by  cabin  or  flight 
crew  members  before  they  become  severe. 

Finally,  it  must  be  noted  that  the  air  conditioning/pressurization  system  which 
is  so  important  to  the  comfort  and  well  being  of  the  inhabitants  of  a  modern 
transport  can  also  be  a  source  of  cockpit  and  cabin  smoke.  The  old  adage  that 
"where  there's  smoke  there's  fire"  is  not  strictly  true  in  an  aircraft.  Smoke 
can  be  generated  within  the  air  conditioning  packs  or  ingested  from  the  outside 
of  the  aircraft  ~nd  distributed  throughout  the  cabin  and  cockpit  by  the  air 
conditioning  system  even  in  the  absence  of  a  fire.  Because  of  the  dangers 
inherent  in  high  smoke  concentrations  in  a  confined  space,  smoke  events  are 
very  much  a  focus  of  interest  in  this  study.  In  fact,  as  the  reader  progresses 
through  this  report,  he  or  she  should  keep  in  mind  that  all  references  to 
"in-flight  fires"  are  intended  to  include  fire  and/or  smoke  events  unless 
specifically  noted  to  the  contrary. 
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EXISTING  APPROACHES.  The  modern  aircraft  cockpit  and  crew  interface  is 
designed  around  a  master  warning  concept.  Under  this  approach,  subsystems 
of  the  aircraft  have  built-in  tests  for  anomalous  conditions.  When  these  exist, 
a  master  warning  horn  or  gong  is  sounded  in  the  cockpit.  This  alerts  the 
pilots  that  a  problem  exists  and  cues  them  to  start  scanning  their  displays  to 
determine  the  source  of  the  trouble.  In  the  case  of  a  few  very  special 
situations  which  require  a  virtually  instantaneous  response  from  the  crew,  a 
unique  auditory  warning  is  used  rather  than  the  general  master  warning  sound. 
This  unique  warning  is  typically  a  synthetic  voice  issuing  a  command.  The 
•’PULL-UP"  message  of  the  Ground  Proximity  Warning  System  (GPWS)  is  one 
example  of  this  approach. 

The  very  latest  generation  of  aircraft  including  the  Boeing  757/767  and  the 
Airbus  Industrie  A310  and  A320  are  characterized  by  a  "glass  cockpit"  and 
digital  data  bus  systems.  The  glass  cockpit  derives  its  name  from  the  use  of 
multiple  cathode  ray  tube  (CRT)  displays  for  the  presentation  of  primary  flight 
data  (attitude,  airspeed,  etc.),  navigation  data  and  system  status.  The 
extension  of  the  master  warning  concept  to  the  glass  cockpit  involves  the  use  of 
a  standard  alerting  signal  and  the  presentation  of  a  description  of  the  failure  or 
emergency  on  one  of  the  system  status  CRTs. 

The  response  of  the  crew  to  a  warning  depends  on  its  nature  and  severity. 
Many  of  the  activations  of  the  master  warning  are  "anticipated."  That  is,  the 
crew  understands  immediately  that  the  warning  has  gone  off  because  of 
something  they  intended  to  do  or  because  of  something  which  just  happened  and 
of  which  they  are  aware.  In  most  aircraft,  for  example,  an  autopilot 
disconnection  will  activate  the  master  warning. 

When  a  master  warning  is  for  a  systems  problem  or  emergency,  the  crew  will 
typically  refer  to  a  standard  checklist  for  handling  the  problem.  The  location 
and  use  of  this  checklist  will  vary  somewhat  as  a  function  of  aircraft  type.  On 
the  older,  conventional  aircraft  the  checklist  is  always  printed.  It  is  generally 
found  in  the  flight  crew  operating  manual  (FCOM)  which  is  carried  on  board. 

It  may  also  exist  in  a  quick  reference  version  placed  within  easy  reach  of  the 
pilots  (often  on  the  glare  shield).  The  quick  reference  checklists  are  usually 
those  used  most  frequently,  e.g.,  takeoff,  landing,  and  those  which  are  most 
time  critical,  e.g.,  emergency  evacuation. 

Some  of  the  newer  high  automation  aircraft,  e.g.,  the  Airbus  A310  and  A320, 
display  the  checklist  along  with  the  description  of  the  problem  on  the  systems 
CRT.  This  appears  to  be  the  trend  in  the  industry  for  future  aircraft 
designs.  It  also  is  an  approach  which  pilots  like  because  it  reduces  the  need 
to  locate  the  FCOM  or  quick  reference  checklist  and  then  find  the  appropriate 
pages  within  it.  Boucek,  Berson,  Summers  and  Hanson  (1985)  found  that  pilots 
generally  wanted  both  warning  and  caution  checklists  to  be  displayed 
automatical!?/. 

The  issue  of  fires,  particularly  in  hidden  spaces  on  transport  aircraft,  is 
addressed  in  quite  different  ways  across  the  existing  commercial  fleet.  Lower 
cargo  compartments  in  large  transport  aircraft  are  categorized  as  either  Class  C 
or  Class  D  types.  Class  D  compartments  are  typically  small  compartments 
designed  to  contain  a  fire  by  oxygen  starvation.  Class  C  compartments  tend  to 
be  larger  and  are  required  to  have  a  fire  detection  and  suppression  system 
(Sarkos,  1985). 
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The  installations  in  Class  C  compartments  typically  consist  of  smoke  (aerosol) 
detectors  which  are  connected  to  a  fire  warning  panel  in  the  cockpit.  The 
initial  alert  to  the  crew  is  through  the  master  warning  horn.  In  order  to 
reduce  false  alarms  arising  from  sensor  failures,  most  systems  currently  being 
installed  employ  two  sensors  at  each  location  connected  logically  by  an  "AND" 
gate,  i.e.,  both  sensors  must  trip  to  produce  a  warning.  Other 
implementations  have  the  two  sensors  in  separate  loops  connected  so  that  if  one 
sensor  trips,  a  caution  is  sounded  and  if  both  trip,  a  warning  is  issued. 

The  typical  smoke  sensor  used  in  current  installations  is  a  photoelectric  device. 
These  operate  on  the  principle  of  light  scatter  due  to  the  particulate  matter  in 
the  air.  A  photocell  is  placed  at  right  angles  to  a  light  source  within  a 
confined  space.  In  the  absence  of  a  significant  concentration  of  particulate 
matter,  little  light  reaches  the  photocell  and  its  voltage  output  remains  low.  If 
the  level  of  aerosol  particulates  increases,  the  light  is  scattered  to  the  photocell 
and  its  voltage  output  increases.  When  this  output  reaches  a  predetermined 
threshold  level,  the  sensor  trips.  The  sensor  is  not  specific  to  airborne 
combustion  products.  Anything  which  enters  the  chamber  and  will  scatter 
light  (e.g.,  water  condensate,  can  generate  an  alarm). 

As  a  result  of  several  lavatory  fire  events  and  to  meet  the  requirements  of 
Federal  Airworthiness  Regulations  (FAR)  121.308  and  121.185,  smoke  detectors 
and  automatic  extinguishers  in  trash  receptacles  have  been  installed  in  aircraft 
lavatories.  In  virtually  all  of  these  retrofits,  the  detector  is  not  connected  to 
the  cockpit  alarms  and  warnings.  Rather,  a  visual  and  aural  warning  is 
sounded  in  the  cabin,  usually  by  activating  the  attendant  call  system  in  the 
lavatory.  Some  of  the  newer  aircraft  produced  after  these  requirements  became 
effective  relay  the  notice  directly  to  the  cockpit  that  the  lavatory  smoke  sensor 
has  activated. 

Cabin  suppression  systems  consist  of  hand  fire  extinguishers  as  well  as  the 
automatic  ones  in  the  lavatory  trash  bins.  Cargo  and  avionics  area  suppression 
systems  for  Class  C  holds  are  normally  two  bottles  of  Freon  or  Halon  gas  which 
can  be  discharged  into  any  of  the  cargo  holds.  If  a  warning  is  issued  from  a 
Class  C  sensor,  the  Flight  Crew  follows  a  checklist  to  isolate  the  involved 
compartment  from  the  ventilation  system  and  discharges  the  first  bottle.  The 
second  bottle  is  discharged  about  an  hour  later  if  the  flight  has  not  yet 
terminated. 

The  human  element  is  an  important  part  of  the  management  of  in-flight  fires. 
First,  human  detection  of  fires  has  traditionally  been  the  primary  mode  by 
which  the  crew  becomes  aware  of  the  problem.  For  example,  Lorengo  and 
Porter  (1986)  report  that  only  146  (11%)  of  1,274  in-flight  fire  and  smoke 
incidents  occurring  between  1979  and  1985  were  accompanied  by  a  sensor  or 
alarm  warning.  It  is  presumed  that  the  balance  and  vast  majority  of  the  fire  or 
smoke  events  were  recognized  by  human  "sensors."  In  fact,  the  battery  of 
human  sensory  mechanisms  is  quite  good  at  detecting  the  products  of 
combustion  once  they  reach  a  threshold  level.  The  problem  is  that  humans 
typically  occupy  only  about  half  of  the  volume  of  a  modern  jet.  A  small  fire  in 
the  remaining,  "hidden”  fuselage  areas  can  grow  to  a  significant  size  by  the 
time  a  human  can  detect  it. 

Humans  also  are  a  critical  element  in  fire  management  systems  because  they 
must  interpret  and  act  upon  warnings  they  sense  or  those  provided  by 
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automated  systems.  As  will  be  illustrated  in  the  developed  scenarios,  many  in¬ 
flight  fire  or  smoke  events  are  made  more  severe  by  the  reluctance  of  the  flight 
crew  to  believe  existing  warnings  and  take  appropriate  actions.  Even  though 
the  standard  operating  procedure  in  the  airline  industry  is  to  land  at  the 
nearest  suitable  airport  whenever  a  fire  warning  activates,  experienced  pilots 
have  deliberately  delayed  landing  while  attempting  to  confirm  automated 
warnings . 

Some  of  this  aberrant  pilot  behavior  is  likely  accounted  for  by  the  relatively 
high  false  alarm  rate  experienced  by  many  existing  sensor  installations.  In 
addition,  most  people  (including  pilots)  do  not  have  a  complete  appreciation  of 
the  mechanism  by  which  fires  propagate  and,  hence,  of  the  limited  time 
available  to  respond.  Human  fallibility,  particularly  under  stress  and  associated 
high  workload  must  also  be  considered. 

THE  ACES  CONCEPT.  The  foregoing  discussion  of  the  current  situation  is  not 
intended  as  a  detailed  treatise  on  existing  regulations  or  practice.  Rather,  it 
is  intended  to  provide  a  basis  for  the  postulation  of  a  new  system,  ACES, 
which  has  the  potential  to  yield  a  marked  improvement  in  performance.  The 
areas  in  which  an  ACES  system  is  expected  to  provide  significant  improvement 
are: 


1.  Sensing  -  There  clearly  is  a  need  for  improved  sensing  of  in-flight  fire  and 
smoke  events.  A  reduction  in  false  alarms,  more  rapid  discrimination  of  real 
events  and  an  extension  of  sensing  to  more  areas  of  the  fuselage  could  all  have 
potential  benefits. 

2.  Alerting  -  Flight  crews  generally  are  notified  as  soon  as  a  fire  is  detected 
by  persons  on  board  or  by  an  automated  system.  Therefore,  there  is  not  a 
great  potential  for  improving  the  speed  of  notification  once  detection  has 
occurred.  However,  the  quality  of  the  information  concerning  the  nature, 
severity  and  location  of  the  fire  can  be  greatly  improved. 

3.  Crew  response  -  It  would  appear  that  much  time  is  lost  during  the 
resolution  of  an  in-flight  fire  event  in  retrieving  and  following  checklist 
procedures.  Thus,  a  benefit  should  be  forthcoming  from  a  system  which 
reduces  this  response  time  while  preserving  or  improving  accuracy. 

4.  Crew  decision  making  -  Problems  are  created  when  the  crew  does  not  accept 

information  from  existing  systems.  Further,  the  available  information  is  often 

incomplete  and  as  a  result  crews  make  faulty  decisions  which  also  delay  the 
application  of  appropriate  countermeasures.  If  a  new  system  proves  reliable, 
crew  confidence  should  increase,  and  situations  in  which  the  crew  wastes  time 
seeking  confirmation  of  the  existence  or  extent  of  a  fire  should  be  reduced. 

These  focal  areas  help  define  the  boundaries  for  postulating  an  ACES  system 
and  assessing  its  feasibility.  They  also  suggest  that  the  time  between  the 
outbreak  of  the  fire  or  the  generation  of  smoke  until  the  aircraft  is  on  the 

ground  and  all  occupants  are  evacuated  should  be  a  primary  criterion  in 

examining  alternative  approaches.  Simply,  the  faster  an  aircraft  involved  in 
a  fire  or  smoke  incident  is  out  of  the  sky,  the  less  time  the  fire  has  to 
propagate  and  generate  hazardous  by-products. 
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The  next  Section  of  this  report  will  detail  the  various  study  activities  which 
provided  the  input  information  needed  to  define  a  prototype  ACES  system  for 
in-flight  fires  and  assess  its  feasibility. 


METHOD 


The  approach  adopted  for  this  ACES  system  technology  assessment  was 
scenario-based.  Under  this  approach,  in-flight  fire  scenarios  played  two 
important  roles.  First,  they  were  the  basis  for  defining  the  "universe”  of  fire 
and  smoke  events  that  the  hypothetical  ACES  system  would  have  to  address. 

As  such,  they  formed  the  input  information  needed  to  describe  the  properties  of 
an  ACES  system  which  might  prove  productive  in  dealing  with  the  problem. 
Second,  they  provided  a  testbed  against  which  proposed  ACES  designs  were 
assessed.  Examinations  of  each  of  the  scenarios  with  and  without  the 
application  of  the  ACES  system  provided  the  basis  for  judging  both  the 
potential  for  help  and  the  likely  extent  of  assistance  the  concept  could  provide. 

The  importance  of  the  scenarios  in  the  study  approach  dictated  the  need  to 
exercise  great  care  in  their  preparation.  The  set  of  scenarios  had  to  represent 
a  reasonable  cross  section  of  actual  in-flight  fire  or  smoke  events  in  order  to 
serve  as  a  basis  for  ACES  design.  Further,  each  scenario  had  to  be 
realistically  and  accurately  portrayed  to  facilitate  the  assessment  of  ACES 
feasibility. 

The  steps  which  were  undertaken  to  implement  the  approach  began  with  an 
analysis  of  the  in-flight  fire  problem.  This  defined  the  universe  of  situations 
which  would  be  studied  and  the  general  content  of  each  scenario.  It  also  led  to 
a  generic  "model”  of  the  in-flight  fire  process  which  could  serve  as  an  outline 
for  scenario  development  and  analysis. 

Since  it  was  clear  that  automatic  sensing  of  combustion  products  had  to  be  an 
inherent  part  of  any  ACES  design,  an  analysis  of  the  state-of-the-art  of  sensor 
technology  was  undertaken  in  parallel  wit'i  the  study  of  the  problem.  Similarly, 
it  appeared  certain  that  computer  support  would  be  needed  for  an  ACES  system 
and  that  some  method  of  alerting  the  crew  would  be  required.  Therefore,  these 
two  areas  were  also  studied  in  some  detail. 

How  each  of  these  tasks  or  sub-studies  was  conducted  will  be  discussed  in  the 
remainder  of  this  section  concluding  with  a  presentation  of  the  scenario 
development  process. 

PROBLEM  ANALYSIS. 

In  the  context  of  a  study  such  as  this,  it  is  typical  to  search  for  problems  with 
the  highest  frequency  of  occurrence  and/or  the  greatest  severity  in  terms  of 
fatalities  and  injuries.  This  was  accomplished  by  reference  to  the  literature 
and  by  searching  the  FAA's  data  bases  of  Service  Difficulty  Reports  (SDRs) 
and  the  Accident /Incident  Data  System  (AIDS). 

Initial  contacts  with  the  literature  and  data  bases  suggested  that  more 
information  would  be  required.  There  are  relatively  few  events  involving  in¬ 
flight  fire  or  smoke.  Lorengo  and  Porter  (1986)  report  on  a  thorough  search  of 
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existing  data.  They  tallied  a  total  of  1,951  reported  incidents  during  the  years 
1964  through  1985.  That  is  a  rate  of  only  about  88  events  per  year.  In 
addition,  they  reported  that  many  of  the  data  sources  were  incomplete  or 
overlapped.  To  place  this  frequency  in  context,  Starrett,  Lopez,  Silverman, 
Susersky  and  Logan  (1976)  reported  that  the  rate  of  in-flight  fires  associated 
with  an  injury  or  fatality  between  1964  and  1974  was  approximately  0.1  per 
million  departures.  Even  considering  only  incidents  (those  events  which  result 
in  damage  to  the  aircraft  but  not  necessarily  loss  of  life  or  serious  injury) ,  the 
rate  reported  is  only  14.9  per  million  departures. 

It  was  also  clear  from  an  examination  of  the  data  bases  and  summaries  of  events 
that  more  detailed  information  would  be  needed  to  support  scenario  development. 
It  is  not  sufficient  to  know,  for  example,  that  a  fire  occurred  in  a  cargo 
compartment  and  resulted  in  a  loss  of  life.  In  order  to  assess  the  ACES,  it 
was  necessary  to  determine  with  some  degree  of  accuracy  the  chronological 
events  beginning  with  the  start  of  the  fire  and  ending  with  its  resolution  as  an 
accident  or  incident. 

Analyses  and  anecdotal  reports  from  aircraft  manufacturers  and  airline 
personnel  suggested  that  detailed  data  of  the  type  needed  could  best  be 
obtained  from  two  sources.  The  first  was  the  aircraft  accident  reports 
produced  by  the  National  Transportation  Safety  Board  (NTSB)  based  on  its 
investigations.  NTSB's  inquiries  and,  hence,  its  reports  are  often  quite 
detailed  and  delve  into  all  aspects  of  an  accident.  Unfortunately,  the  level  of 
detail  in  the  NTSB  reports  is  directly  related  to  the  severity  of  the  accident. 
After  major  events  characterized  by  significant  loss  of  life,  the  NTSB  report 
contains  all  of  the  detail  needed  for  the  development  of  a  scenario  and  the 
definition  of  the  event  timeline  for  the  accident.  For  incidents  or  accidents 
with  minor  consequences,  the  NTSB  reports  are  more  sparse  and  typically  do 
not  contain  all  of  the  information  upon  which  to  base  a  scenario. 

The  second  source  of  data  was  operating  airlines  and  major  airframe 
manufacturers.  These  groups  maintain  excellent  records  on  all  of  the  incidents 
surrounding  the  operation  of  their  fleets.  Their  internal  reports,  even  for  a 
relatively  minor  incident,  can  be  quite  complete.  Although  these  data  are 
typically  not  available  to  the  public,  excellent  cooperation  was  received  from  all 
of  the  airlines  and  airframe  manufacturers  approached  during  this  study. 

During  the  compilation  of  accidents  and  incidents  from  the  literature,  FAA, 
NTSB  and  industry  sources,  it  became  clear  that  false  alarm  events  were  also  a 
problem  and  source  of  concern.  The  consequences  of  a  false  fire  warning  can 
be  quite  severe.  If  a  false  warning  is  totally  accepted  as  real  by  the  flight 
crew,  it  can  lead  to  an  emergency  landing  and  evacuation  of  the  aircraft.  This 
often  results  in  injuries  during  the  emergency  egress  from  the  aircraft.  Even 
if  the  crew  suspects  a  false  alarm  and  merely  diverts  the  flight  without  an 
emergency  evacuation,  there  are  undesirable  consequences.  At  the  very  least, 
an  airline's  public  image  is  marred  by  the  inconvenience  and  emotional  upset 
suffered  by  a  plane  load  of  people  making  an  unscheduled  landing. 

Three  distinct  types  of  fire  or  smoke  events  in  addition  to  false  alarms  emerged 
from  the  problem  analysis.  The  first  were  the  major  disasters  resulting  from 
in-flight  fires.  Documentation  of  these  events  was  extremely  thorough  by  the 
NTSB  or  other  investigating  agency.  Since  these  events  had  actually  happened 
and  claimed  significant  numbers  of  lives,  it  appeared  reasonable  to  fashion 
scenarios  based  on  them. 
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The  second  type  of  event  included  incidents  (or  potential  incidents)  in  the 
concealed  or  "hidden"  areas  of  the  aircraft.  Information  about  these  was  more 
speculative  than  the  major  accidents  and  not  as  well  documented  but  still 
represented  real  concerns  to  the  industry. 

The  third  type  was  essentially  similar  to  the  second  except  that  the  incident 
occurred  in  the  occupied  cabin  areas  of  the  aircraft.  Fire  and  smoke  events  in 
the  cabin  are  typically  less  severe  than  those  in  hidden  spaces  because  they 
are  rapidly  detected  by  the  "human  sensors,"  and  they  are  accessible  for 
suppression  efforts.  This  raises  the  issue  of  whether  a  computer-based  system 
for  dealing  with  fires  such  as  ACES  should  even  include  consideration  of  fire  or 
smoke  events  which  occur  in  the  open,  occupied  spaces  of  an  aircraft.  The 
best  way  to  make  this  judgment  seemed  to  be  to  include  them  in  one  or  more 
scenarios  for  assessment  in  the  study  process. 

The  problem  analysis  led  most  directly  to  the  enumeration  of  many  possible 
scenarios  and  the  development  of  13  specific  ones  used  in  the  study.  The 
scenario  development  process  is  described  beginning  on  page  23.  The  use  of 
of  the  problem  descriptions  was  not,  however,  limited  to  the  scenario 
development.  The  problem  descriptions  were  also  important  in  establishing  the 
bounds  of  the  sensor,  the  computer  support  and  the  cockpit  interface  analyses. 
These  analyses  are  described  below. 

SENSOR  ANALYSIS. 

The  basic  concept  of  the  ACES  system  is  to  provide  assistance  to  the  crew  in 
detecting  and  managing  in-flight  fires.  Inherent  in  this  concept  is  the  notion 
that  the  system  would  automate  some  or  all  of  the  sensing,  information 
gathering  and  decision-making  activities  necessary  to  reduce  the  severity  of 
in-flight  fires.  Thus,  an  analysis  of  the  state-of-the-art  of  sensors  for  use  in 
transport  aircraft  had  to  be  undertaken  to  provide  important  feasibility 
information.  Direct  contacts  with  manufacturers  of  sensing  devices  and  their 
literature  were  the  primary  sources  of  information  for  defining  the  role  of 
sensors  in  an  ACES  system. 

Early  detection  of  the  presence  of  a  fire  is  an  essential  element  in  a  fire  safety 
system.  From  the  moment  of  smoldering  or  flaming  combustion,  fire  produces 
changes  in  the  surrounding  environment.  In  addition  to  thermal  energy,  solid 
and  liquid  particles  and  gases  are  introduced.  With  incipient  fires,  such 
changes  can  also  occur  well  before  actual  smoldering  or  flaming.  For  the 
purposes  of  the  following  discussion,  it  will  be  helpful  to  define  a  few  terms 
related  to  fire  detection. 

In  1974  the  term  "fire  signature"  was  introduced  to  describe  any  product  of  a 
fire  that  changes  the  ambient  conditions  and  is  practical  for  detection  purposes 
(Custer  and  Bright,  1974).  At  that  time  detection  was  limited  to  determination 
of  the  presence  or  absence  of  a  fire.  No  information  was  generated  that  could 
discriminate  between  smoldering  and  flaming  fires  or  between  the  slow  buildup 
of  cigarette  smoke  or  condensed  moisture  and  an  actual  fire.  Present 
technology  permits  assessment  of  both  the  instantaneous  level  of  the  fire 
product  and  the  rate  of  change  of  that  product  over  time.  Thus,  the  term 
signature  as  used  in  the  concept  of  an  ACES  system  will  be  expanded  to  include 
both  the  type  of  signature  being  sensed  and  its  rate-of-change  history. 
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To  be  useful,  the  change  in  the  ambient  conditions  for  a  given  signature  must 
exceed  the  changes  that  could  be  due  to  non-fire  conditions.  Not  all  fire 
signatures  are  suitable  for  fire  detection  purposes.  In  an  unheated  aircraft 
cargo  compartment,  for  example,  temperature  increases  during  descent  might  be 
interpreted  as  a  possible  fire.  In  a  case  such  as  this  where  a  false-positive 
alarm  can  result  in  a  major  effect  such  as  an  emergency  landing  when  there  is 
no  fire,  sensor  systems  monitoring  conditions  associated  with  several  different 
signatures  are  advisable.  All  other  factors  being  equal,  such  as  response  time, 
weight  and  cost,  the  preferred  signatures  will  be  those  that  are  most  specific  to 
the  types  of  fire  likely  to  be  experienced  and  can  generate  the  highest  signal 
to  noise  ratio  in  the  earliest  period  of  fire  development. 

The  term  "sensor"  as  used  in  this  report  refers  to  the  mechanism  that  responds 
to  the  presence  of  a  given  signature  such  as  smoke  or  heat.  A  "detector"  is 
the  assembly  that  houses  the  sensor  and  any  power  supply  or  electronic 
circuitry  associated  with  the  sensor.  If  the  circuitry  to  process  the  signal  from 
the  sensor,  a  device  to  sound  the  alarm  and  the  power  supply  are  all  within 
this  housing,  the  unit  is  a  "single  station"  detector  and  can  stand  alone. 
Single  station  devices  are  also  available  that  can  permit  remote  sounding  of  the 
audible  alarm.  If  only  the  sensor  and  signal  processing  circuits  are  present, 
the  device  is  a  "multiple  station"  detector  and  requires  a  remote  alarm  panel, 
power  supply  and  other  equipment.  A  multiple-station  device,  then,  is  part  of 
a  fire  detection  "system." 

Detectors  are  generally  categorized  by  the  signature  being  sensed  (i.e.,  heat, 
smoke,  etc.)  and  by  the  installation  geometry.  Detectors  classified  by 
installation  geometry  may  be  of  the  spot-type  that  sense  the  conditions  at  a 
specific  location  in  a  compartment  or  space  or  of  the  line-type  where  conditions 
over  an  area  or  along  the  line  can  be  monitored.  Where  air  handling  systems 
are  present,  it  is  possible  to  monitor  conditions  in  a  "volume"  by  placing  a 
spot-type  detector  in  a  heating,  ventilating  or  air  conditioning  (HVAC)  exhaust 
duct.  In  large  volumes  or  with  large  air  flow  rates,  sensing  of  fire  signatures 
may  be  delayed  due  to  dilution  effects. 

Regardless  of  the  signature  being  sensed,  most  detectors  in  use  today  respond 
in  a  binary,  i.e.,  fire/no-fire  mode.  This  limits  the  amount  of  information 
which  the  sensing  subsystem  can  provide  to  the  decision-making  part  of  an 
ACES  system.  In  a  binary  mode,  a  threshold  level  must  be  set.  No  alarm  is 
sounded  if  the  sensed  level  is  below  that  threshold.  If  the  threshold  is  set  too 
high,  fire  and  smoke  incidents  are  allowed  to  develop  to  significant  levels 
before  an  alarm  is  sounded.  If  the  threshold  is  set  too  low,  excessive  false 
alarms  are  possible. 

In  order  to  overcome  the  limitations  of  a  binary  detector,  it  is  useful  as  part  of 
the  ACES  concept  to  consider  continuous  or  analog  signals  as  output  from  the 
detector.  The  technology  for  analog  fire  signature  sensors  exists  today  and 
will  be  discussed  with  individual  fire  signatures  and  sensor  mechanisms  below. 

AEROSOL  SIGNATURES.  Beginning  with  the  preignition  phase  of  a  fire,  large 
numbers  of  solid  and  liquid  particles  are  introduced  into  the  atmosphere. 
During  the  preignition  phase,  the  particles  are  of  submicron  size  (5xl0-4  to 
1x10-^  micrometers)  and  are  produced  at  temperatures  well  below  ignition. 
Since  particles  below  10-11  micrometers  do  not  scatter  visible  light  efficiently, 
they  are  referred  to  as  invisible  aerosols.  As  the  ignition  temperature  of  a 


10 


material  is  reached,  the  concentration  of  invisible  aerosols  increases  to  the  point 
where  larger  particles  are  produced  by  coagulation  (Rodebush,  1950).  As  the 
process  continues,  small  particles  disappear  by  coagulation  or  evaporation,  the 
large  particles  fall  out  of  suspension  and  the  remaining  stable  aerosol  will  have 
a  size  distribution  between  0.1  and  1.0  micrometers.  Both  invisible  and  visible 
particles  will  be  present. 

Aerosol  size  distribution  is  related  to  whether  the  combustion  process  is 
smoldering  or  flaming  (Bukowski  and  Mulholland,  1978  and  Schiedweiler,  1968). 
In  general,  smoldering  fires  produce  large  particles  (greater  than  0.3 
micrometers)  and  flaming  fires  small  ones  (less  than  0.3  micrometers).  For  both 
fire  types,  however,  the  maximum  particle  population  is  in  the  0.3  micrometer 
and  below  range. 

The  presence  of  aerosols  can  be  sensed  by  several  means,  including  the  use  of 
ionization  chambers  and  light  scattering  or  attenuation  devices.  The 
environmental  effect  of  fire  measured  by  ionization  sensors  is  the  change  in 
conductivity  of  ionized  air  with  increasing  smoke  concentration.  The  ionization 
sensor  consists  of  an  ionized  air  space  between  two  plates,  one  charged 
positively  and  the  other  charged  negatively.  The  ionization  energy  is  provided 
by  a  small  alpha  or  beta  radiation  source,  usually  Americium  241,  directing 
energy  between  the  plates.  In  the  standby  condition  (no  "smoke"),  a  small 
current  (10-11  amps)  flows  across  the  chamber  and  is  the  baseline  signal. 

When  aerosol  enters  the  chamber,  the  mobility  of  the  ions  is  reduced  and  the 
current  flow  through  the  chamber  decreases.  In  most  aerosol  or  "smoke" 
detectors,  a  predetermined  change  in  the  baseline  current  flow  through  the 
sensor  is  established  as  an  alarm  threshold .  When  the  threshold  is  reached ,  a 
normally  open  circuit  is  closed  and  the  alarm  is  transmitted.  This  type  of 
operation  of  the  detector  would  be  a  binary,  i.e.,  fire/no-fire  mode. 

In  order  to  represent  fully  a  fire  signature  as  defined  above,  the  actual 
continuous  output  signal  from  an  ionization  detector  must  be  available  so  that 
the  rate  of  change  of  the  signal  can  be  assessed.  A  detector  providing  this 
feature  would  be  operating  in  an  analog  mode.  Since  the  ionization  chamber 
produces  a  continuous  change  in  current  that  is  proportional  to  the 
concentration  of  aerosol  present,  all  that  is  needed  is  circuitry  that  will  process 
the  sensor  output  so  that  the  rate  of  change,  as  well  as  the  instantaneous 
value,  can  be  determined  over  time  either  at  the  detector  or  at  a  remote 
location.  Analog  ionization  chamber  detectors  are  available  commercially  for  use 
in  building  fire  detection  systems.  They  will  be  discussed  later  in  this  report. 

Ionization  chamber  detectors  are  considered  spot  devices  and  are  generally 
installed  at  regular  intervals  on  ceilings  or  on  walls  close  to  the  ceiling.  In 
small  confined  spaces,  a  single  detector  is  often  adequate.  HVAC  exhaust  duct 
installations  are  also  employed. 

Fire  aerosols  will  affect  the  propagation  of  light  passing  through  the  air.  A 
beam  of  light  of  a  given  intensity  in  clear  air,  for  example,  will  be  attenuated 
exponentially  as  a  function  of  the  length  of  the  beam,  the  concentration  of 
particles  and  their  optical  properties.  When  the  signal  is  attenuated  to  a 
predetermined  level,  the  alarm  is  sounded.  The  light  source  may  be  a  laser  or 
incandescent  bulb.  A  variety  of  photo  sensors  such  as  cadmium  sulfide  cells 
are  used  as  receivers.  These  detectors  are  called  projected  beam  detectors  and 
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are  generally  used  to  supervise  large  open  spaces.  Projected  beam  detectors 
are  line-type  devices.  In  order  for  these  systems  to  function,  a  clear 
line-of-sight  path  must  be  maintained.  This  requirement  would  make  beam 
detectors  unsuitable  for  most  ACES  applications. 

The  presence  of  particles  also  scatters  light,  a  process  that  is  clearly 
demonstrated  by  the  "shaft"  of  light  created  by  a  slide  projector  in  a  room  in 
which  people  are  smoking.  The  scattering  efficiency  is  related  to  the  wave 
length  of  the  light  and  the  size  of  the  particles  (Bukowski  and  Mulholland, 
1978).  The  nearer  the  particle  diameter  is  to  the  wavelength  of  the  incident 
light,  the  more  light  energy  is  scattered.  Light  in  the  ultraviolet  range,  such 
as  from  a  xenon  discharge  tube,  will  scatter  far  better  from  particles  smaller 
than  0.1  micrometer  (those  related  to  flaming  and  rapidly  growing  fires)  than 
particles  approaching  1.0  micrometer  (those  associated  with  smoldering  fires). 
Infrared  energy  has  wavelengths  on  the  order  of  0.4  to  4  micrometers  and 
scatters  more  efficiently  from  these  larger  particles. 

The  scattering  sensor  uses  a  light  source  and  a  photo  sensor  receiver 
arranged  so  that  no  light  from  the  source  is  seen  by  the  receiver.  Light 
sources  are  usually  red  or  infrared  light  emitting  diodes  (LED).  The  more 
sensitive  light  scattering  sensors  use  xenon  sources.  This  source  has 
significant  energy  in  the  ultraviolet,  thus  making  it  particularly  sensitive  to  the 
small  particles  generated  early  in  the  fire.  In  the  presence  of  smoke  aerosol, 
light  is  scattered  into  the  receiver.  The  receivers  are  commonly  silicon  cells. 
The  receiver  provides  a  continuous  analog  output  of  the  change  in  smoke 
concentration,  and,  when  a  predetermined  level  is  reached,  the  alarm  sounds. 
Thus,  in  its  typical  installation,  the  scattering  sensor  operates  in  a  binary 
mode.  The  scattering  sensor  is  the  type  most  commonly  found  in  the  cargo 
holds  on  commercial  aircraft  today.  Because  of  its  propensity  to  be  "tricked" 
by  any  nonfire  aerosol  which  will  scatter  light,  it  is  generally  installed  in 
batteries  of  two  sensors  connected  by  an  "AND"  gate. 

ENERGY  RELEASE  SIGNATURES.  Throughout  its  course,  a  fire  is  continuously 
releasing  energy  into  the  environment.  The  rate  at  which  the  energy  is 
released  changes  with  time,  producing  several  useful  fire  signatures.  The 
energy  release  signatures  can  be  further  subdivided  on  the  basis  of  the  mode 
of  heat  transfer  involved:  radiation  or  convection. 

Radiated  energy  signatures  are  found  in  the  ultraviolet  and  infrared  ranges  of 
the  energy  spectrum  and  are  characterized  by  discrete  sets  of  spectral  peaks 
and  oscillatory  frequencies  that  are  associated  with  flames.  Strong  infrared 
emissions  from  burning  hydrocarbons  (plastics,  liquid  fuels  etc.),  for  example, 
are  found  in  the  4.4  micrometer  region  due  to  the  presence  of  C02  and  in  the 
2.7  micrometer  region  due  to  water  vapor.  Another  infrared  signature  is  a 
characteristic  "flicker  frequency"  on  the  order  of  5  to  15  hertz.  Combining 
sensors  for  all  three  of  the  above  signatures  in  one  detector  or  detection 
system  reduces  the  likelihood  of  false  alarms.  The  sensors  used  are 
photosensitive  cells,  either  doped  or  filtered  to  screen  out  all  radiation  but  the 
infrared  signatures.  Ultraviolet  signatures  for  flames  exist  in  the  0.27  to  0.29 
micrometer  range  due  to  the  presence  of  CO,  C02  and  OH  radicals.  Detectors 
using  radiated  energy  signatures  are  employed  in  aircraft  engine  fire  detection 
systems.  Radiant  energy  detectors  can  be  considered  to  supervise  a  volume  in 
that  a  flame  will  be  sensed  anywhere  in  the  volume  given  that  it  can  be  "seen." 
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Convected  energy  signatures  are  related  to  increases  in  air  temperature  due  to 
the  fire.  Like  smoke,  the  signature  is  represented  by  the  time/rate-of-change 
history  of  the  sensor  output.  Smoldering  or  slowly  developing  fires  will  have 
low  heat  output  and  temperatures  will  rise  slowly.  Once  flaming  develops,  fires 
tend  to  grow  exponentially  as  a  function  of  time.  Typical  flaming  fires  such  as 
burning  furniture  grow  at  a  rate  equivalent  to  the  square  of  time.  A  flammable 
liquid  fire  may  have  an  exponent  of  four  (see  Figure  1).  The  actual  rate  of 
development  of  the  various  fire  signatures  will  depend  on  the  configuration  of 
the  fuel,  the  geometry  of  the  compartment  and  the  ventilation. 

Sensors  for  convected  energy  signatures  rely  largely  on  physical,  electrical  or 
chemical  changes  caused  by  to  generate  a  signal.  These  sensors  operate  in 
both  binary  and  analog  modes  and  can  be  of  either  spot  or  line-type.  The 
binary  devices  use  the  mechanical  energy  of  expanding  metals  or  gases  or  the 
melting  of  a  eutectic  material  to  open  or  close  a  contact  initiating  an  alarm. 
The  expansion  of  air  against  a  flexible  diaphragm,  for  example,  is  used  to 
operate  contacts  in  line-type  pneumatic  tube  systems  and  in  spot-type  devices. 
Binary  heat  detectors  will  initiate  an  alarm  when  a  specified  rate  of  temperature 
rise  is  reached  or  at  a  specified  fixed  temperature.  Temperature  settings  are 
typically  available  between  135°F  and  500°F. 

Some  convected  energy  sensors  produce  a  continuous  output  which  is  the  analog 
of  temperature.  Thermocouples,  thermopiles,  and  thermistors  are  spot-type 
devices  producing  either  a  millivolt  signal  or  a  change  in  resistance  as  a 
function  of  temperature. 

Continuous  wire  heat  sensors  consist  of  a  tube  containing  a  coaxial  center 
conductor.  Surrounding  the  center  conductor  and  filling  the  outer  tube  or 
sheath,  is  a  material  that  reacts  to  heat  by  changing  the  resistance  or  the 
capacitance  between  the  center  conductor  and  the  sheath.  A  variety  of 
different  materials  are  used  for  each  of  the  elements  in  these  devices. 
Continuous  wire  heat  detectors,  although  generally  used  with  binary  mode 
control  units,  often  have  sensors  that  produce  a  continuous  analog  of 
temperature.  One  unique  line- type  detector  uses  an  optical  fiber  sensor  that 
progressively  attenuates  a  light  signal  passing  through  it  in  response  to 
increasing  temperature. 

MISCELLANEOUS  SIGNATURES.  Fire  produces  a  large  number  of  chemical 
species  such  as  water,  carbon  monoxide,  hydrogen  chloride  and  hydrogen 
cyanide  among  many  others.  Except  for  very  special  industrial  applications, 
the  fire  gas  signatures  are  not  used  routinely  for  detection. 

AVIATION  INDUSTRY  FIRE  SENSORS.  In  the  process  of  examining  the  generic 
types  of  sensors  available  for  use  in  an  ACES  system,  several  manufacturers 
were  contacted  and  supplied  information.  It  was  not  the  intent  of  this  study  to 
conduct  a  survey  of  all  available  sensors.  However,  the  information  collected 
on  specific  products  is  believed  to  be  highly  illustrative  of  existing  technology 
which  could  be  applied  to  an  ACES  design.  Therefore,  it  was  decided  to 
include  herein  a  sampling  of  specific  product  references  as  a  demonstration  of 
the  extent  to  which  an  ACES  could  be  designed  with  "off  the  shelf  sensors. 
The  fact  that  a  particular  product  or  manufacturer  is  or  is  not  mentioned 
should  not  be  construed  as  an  endorsement  (or  lack  thereof)  of  that 
product/ manufacturer  by  the  project  or  the  FAA.  The  sensors  discussed  below 
are  already  in  use  by  the  aviation  industry  and  meet  the  appropriate  FAA  and 
Military  specifications.  They  are  a  representative  sample  of  available  devices. 
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FIRE  GROWTH 
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FIGURE  1.  EXAMPLES  OF  FIRE  GROWTH  RATES 
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Heat  Sensors.  Aviation  heat  sensors  are  available  in  both  spot  and  line 
configurations .  Products  by  three  companies  were  reviewed,  Graviner  (UK), 
ARMTEC  (USA)  and  Fenwal  (USA). 

All  three  manufacturers  produce  line-type  or  continuous  wire  sensors. 
The  Fenwal  device  uses  a  eutectic  salt  as  the  heat  sensitive  element  in  a  coaxial 
configuration.  As  the  salt  approaches  its  melting  point,  the  impedance  drops 
suddenly  allowing  current  to  flow.  Since  the  melting  point  is  actually  the  "set 
point"  of  the  sensor,  this  is  considered  a  binary  device. 

The  line-type  sensors  made  by  Graviner  and  ARMTEC  react  continuous^  to 
changes  in  the  ambient  temperature.  The  Graviner  sensor  responds  with 
changes  in  both  the  resistance  and  the  capacitance  of  the  circuit  containing  the 
sensor.  As  temperature  increases,  resistance  decreases  and  capacitance 
increases.  In  present  applications,  when  the  resistance  and  capacitance  both 
reach  predetermined  levels,  an  alarm  is  sounded.  Although  the  alarm  function 
is  binary  in  nature  for  the  detector,  the  sensor  itself  is  analog. 

The  ARMTEC  line-type  detector  also  uses  an  analog  sensor.  Here,  the 
heat  responsive  element  is  a  metal  oxide  semiconductor  (MOS)  that  changes 
resistance  inversely  with  temperature.  As  in  the  case  of  the  Graviner  detector, 
the  sensor  output  is  used  to  activate  a  binary  signal  to  an  alarm  system. 

Fenwal  produces  two  spot -type  detectors.  One  operates  in  a  binary  mode 
when  a  pair  of  contacts  is  closed  by  the  forces  created  by  differentially 
expanding  metals.  The  other  uses  a  thermistor  as  the  sensor.  A  thermistor  is 
a  solid  state  temperature  measuring  device.  As  in  the  line  sensors  discussed 
above,  the  thermistor  continuously  changes  resistance  inversely  with 
temperature  and  thus  is  an  analog  device. 

Smoke  Sensors.  The  aviation  smoke  detectors  on  the  market  operate  on 
the  same  principles  as  most  commercial  devices  using  either  photoelectric  cr 
ionization  type  sensors.  Although  an  analog  signal  is  produced  by  both 
sensors,  the  available  detectors  produce  either  a  binary  output  or  a  two  level 
alarm.  Aviation  smoke  detectors  are  available  for  both  ceiling  mounting  and 
HVAC  duct  operation. 

The  sensor  in  a  photoelectric  detector  produced  by  Fenwal  uses  the  light 
scattered  from  a  red  light  emitting  diode  into  a  silicon  photosensor  to  monitor 
the  levels  of  smoke  present.  The  detector  has  two  levels  of  binary  output: 
"pulsing"  as  a  pre-alarm  (low  level  of  smoke);  and,  "steady"  as  the  alarm  mode 
(threshold  level  of  smoke) .  It  is  possible  that  the  circuitry  built  into  the 
detector  could  be  redesigned  to  produce  an  analog  output  as  has  been  done 
with  the  commercial  detectors  discussed  below. 

COMMERCIAL  SENSORS.  Commercial  sensors  and  detectors  differ  from  aviation 
devices  primarily  in  that  they  are  not  generally  designed  and  tested  to 
withstand  the  rigors  of  flight.  Given  the  need,  it  appears  technically  feasible 
to  upgrade  suitable  commercial  detectors  to  meet  the  necessary  FAA  or  industry 
standards. 

Heat  Sensors.  A  number  of  commercial  heat  detectors  with  analog  sensors 
or  output  are  available  for  both  spot  and  line  applications.  The  sensors 
operate  on  the  same  principles  as  the  aviation  devices  above.  Since  devices 


15 


already  exist  that  meet  FAA  and  Military  Requirements,  no  extensive  review  of 
commercial  heat  detectors  was  undertaken.  A  recently  introduced  optical  fiber 
heat  sensor  does,  however,  warrant  discussion  as  a  possible  ACES  sensor 
candidate . 

Produced  by  Systecon,  Inc.,  the  sensor  is  a  fiber  optic  loop  with  an  LED 
light  source  at  one  end  and  a  photosensor  at  the  other  end.  The  fiber 
conductor  has  optical  properties  such  that  exposure  to  heat  reduces  the  light 
transmission  characteristics.  In  the  present  configuration  of  the  detector,  the 
output  from  the  optical  sensor  is  monitored  and  when  the  light  level  at  the 
photosensor  is  reduced  to  35  percent,  a  trouble  signal  (binary)  is  triggered. 
When  the  level  of  attenuation  reaches  50  percent,  a  fire  signal  (binary)  is  sent. 
Although  the  detection  system  is  not  analog,  the  sensor  is. 

Smoke  Sensors.  Aerosol  sensors  used  in  smoke  detectors  all  produce 
continuous  analog  outputs.  Like  heat  detectors  with  analog  sensors,  smoke 
detectors  employ  an  electronic  circuit  designed  to  respond  at  a  predetermined 
sensor  output  level  to  generate  binary  alarm  conditions.  Some  smoke  detectors 
provide  a  continuous  analog  output.  Photoelectric  and  ionization  devices  are 
available  with  alarm  systems  from  a  number  of  sources  including  Autocall  (US), 
Apollo  (UK)  and  Nittan  (UK/Japan).  Rather  than  use  the  term  "detector"  for 
these  devices,  they  are  called  "fire  monitors,"  "smoke/heat  sensors,"  "analog 
sensors"  or  "analog  detectors."  These  are  all  spot-type  devices. 

When  a  fire  is  in  its  earliest  stages,  very  little  heat  is  produced,  and  the 
smoke  aerosols  are  transported  largely  by  the  movement  of  ambient  air.  When 
there  is  little  air  movement  or  if  extremely  early  notification  of  a  possible  fire 
in  a  critical  area  is  desired,  submicron  particle  counting  detection  systems  are 
available  that  periodically  sample  the  air  in  the  area  protected.  The  samples 
are  drawn  to  a  sensing  chamber  where  the  level  of  aerosol  present  is  measured 
and  an  analog  output  is  produced.  The  two  units  available  operate  on  different 
principles,  but  both  respond  to  submicron  sized  particles,  the  earliest 
detectable  fire  signature. 

One  detection  system  produced  by  Environment-One  draws  the  sample  into 
a  chamber  containing  air  at  100  percent  relative  humidity.  By  lowering  the 
pressure  in  the  chamber,  water  condenses  on  the  submicron  particles  allowing 
them  to  scatter  light  in  proportion  to  the  number  of  particles  present.  The 
present  configuration  has  a  slow  sampling  rate  of  four  zones  a  minute.  Usually 
a  zone  is  a  separate  compartment.  Each  zone  is  analyzed  once  each  second  for 
the  sampling  period.  While  not  a  continuous  analog  output,  the  sampling  rate 
could  be  increased  by  having  more  than  one  zone  in  a  compartment.  Four 
zones  per  compartment  or  continuous  sampling  of  a  single  zone  could  make  this 
device  fully  analog. 

The  Vesda  detector  by  Fenwal  uses  the  very  short  wavelength  light 
(ultraviolet)  from  a  xenon  lamp  to  achieve  scattering  from  the  submicron 
aerosols.  This  is  also  a  sampling  system  but  uses  a  separate  sensor  for  each 
zone.  Each  zone  then  is  monitored  continuously  by  the  xenon  lamp  sensor  and 
an  analog  output  is  provided. 

One  consideration  with  sampling  detectors  is  the  transit  time  when  there 
are  long  runs  of  tubing  from  the  sampling  head  to  the  sensor.  This  delay  is  to 
some  extent  compensated  for  by  the  extreme  sensitivity  of  both  of  the  devices 
described  above. 
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"INTELLIGENT”  ALARM  SYSTEMS.  Given  that  analog  sensors  are  available  for 
heat  and  smoke,  an  "intelligent"  alarm  system  is  possible.  In  this  context, 
"intelligence"  connotes  the  ability  to  exercise  decision-making  and  employ 
adaptive  threshold  criteria.  With  an  intelligent  system,  a  number  of  algorithms 
for  alarm  levels  can  be  developed  ranging  from  a  simple  two  level  approach  to  a 
complex  decision-making  model  based  on  such  variables  as  sensor  signal  history, 
rate  of  increase  of  signal  and  forecasted  time  to  critical  heat  or  smoke 
conditions.  An  intelligent  alarm  system  using  current  technology  might  also 
employ  a  capability  to  address  and  poll  each  heat  and  smoke  sensor,  record  its 
signal  level  as  a  data  point  and  use  the  data  in  an  alarm  algorithm.  In 
addition,  sensors  could  be  monitored  for  contamination  and  operational  status. 

A  review  of  the  literature  reveals  the  existence  of  a  number  of  alarm  systems 
that  employ  analog  sensors  and  some  level  of  alarm  logic.  In  an  April  1985 
article  in  Fire  Surveyor,  eleven  such  systems  available  in  England  were 
reviewed.  Three  systems  were  described  that  meet  all  the  requirements  for 
"intelligence"  and  might  be  considered  analogous  to  an  ACES  system  for 
aircraft.  They  were  made  by  Chubb  (UK),  Nittan  (UK/Japan)  and  Hakuto 
(UK/Japan).  The  Chubb  system  supplies  a  standard  serial  computer  output 
through  an  RS-232  interface  and  can  provide  emergency  instructions  by  voice 
or  visual  display  units. 

Autocall  (US)  provides  analog  smoke  detectors  and  employs  fire  algorithms  in  its 
AutoPlex  system.  This  system  is  of  particular  interest  because  it  uses  more 
than  one  sensor  mode  and  is  intelligent.  Although  the  present  AutoPlex  uses 
binary  heat  sensors,  company  representatives  indicate  no  problems  in  providing 
analog  heat  capability. 

Figures  2  and  3  show  algorithms  of  smoke  development  and  alarm  logic 
suggested  by  Hakuto  and  by  Autocall  in  their  corporate  literature.  Figure  2 
shows  smoke  level  on  the  y  axis  and  polling  periods  on  the  x  axis.  The 
horizontal  line  denotes  a  fixed  threshold  for  alarm.  The  three  curves  represent 
three  different  types  of  fire  in  terms  of  smoke  development.  One  shows  rapid, 
intense  development,  one  a  gradual  persistent  development  and  the  third  is  in 
between  these  two.  The  "fire  decisions"  are  the  points  at  which  an  alarm  wovild 
be  generated.  Two  of  the  curves  show  a  reduction  in  smoke  development 
leading  to  a  "no  fire"  decision.  Figure  3  is  very  similar  to  Figure  2: 
essentially  the  same  three  types  of  fire  are  depicted.  The  alarm  logic  is 
depicted  by  the  symbol  aligned  with  the  appropriate  number  of  sampling 
periods.  These  algorithms  are  examples  only.  Representative  aircraft  fire 
algorithms  would  be  developed  for  the  ACES  system.  The  examples  shown  here 
are  illustrative  of  the  logic  which  can  be  employed  in  an  intelligent  system. 

Based  on  a  review  of  the  analog  fire  sensing  technology  available  today  and  the 
current  state  of  the  art  in  intelligent  alarm  processing  equipment,  it  is  feasible 
to  conceive  of  developing  an  ACES  using  existing  hardware.  Development  could 
likely  be  undertaken  with  either  a  minimal  modification  of  existing  aircraft  fire 
sensors  or  by  upgrading  current  commercial  analog  smoke  sensors  to  meet  FAA 
and  industry  standards.  In  addition,  the  ACES  would  require  the  development 
of  appropriate  alarm  algorithms  that  are  specific  to  in-flight  fire  scenarios. 
These  would  then  have  to  be  implemented  in  software  on  an  appropriate 
processor  in  order  to  render  the  system  intelligent. 
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COMPUTER  PROCESSING  ANALYSIS. 

The  basic  ACES  concept  to  be  assessed  assumed  that  the  system  would  have  an 
inherent  degree  of  intelligence  beyond  that  attainable  with  a  conventional 
sensing  system.  This  intelligence  would  allow  the  ACES  to  adapt  its  criteria  to 
differing  flight  missions  in  order  to  achieve  an  overall  system  goal  of  maximizing 
correct  fire/ smoke  incident  detections  and  minimizing  false  alarms. 

The  need  for  remote  sensors  and  the  desire  to  minimize  crew  workload  led  to 
the  decision  that  the  ACES  system  would  be  computer-aided.  The  type  of 
adaptive  logic  to  be  applied  suggested  that  a  fully  developed  ACES  would 
operate  as  an  expert  system.  In  this  study,  however,  no  attempt  was  made  to 
develop  and  assess  a  classical  expert  system.  Rather,  the  goal  was  to 
determine  if  the  expertise  of  an  aircraft  fire  safety  specialist  could  be  captured 
and  emulated  in  software  and  applied  in  flight.  As  will  be  seen  from  the 
definition  of  the  hypothetical  ACES  later  in  this  report,  the  system  as 
formulated  does,  however,  have  many  of  the  characteristics  of  a  true  expert 
system . 

In  light  of  the  need  to  support  ACES  software  on  board  a  commercial  transport, 
study  efforts  were  devoted  to  an  analysis  of  available  or  attainable  computer 
hardware  and  software  support.  The  present  day  jet  aircraft  has  numerous 
dedicated  processors  which  are  designed  to  perform  one  or,  at  most,  a  few 
tasks.  The  Flight  Warning  Computer  (FWC)  and  the  Flight  Management 
Computer  (FMC)  are  two  examples  of  major  processors  found  on  aircraft  such  as 
the  Airbus  Industrie  A310.  The  FWC  collects  aircraft  system  data  and 
generates  appropriate  warning  stimuli  when  needed.  The  FMS  manages  the 
navigation  of  the  aircraft  according  to  a  programmed  flight  plan. 

Initial  efforts  were  devoted  to  determining  the  feasibility  of  having  the  ACES 
system  share  an  existing  processor.  Using  an  existing  processor  would 
minimize  the  cost  of  new  hardware  for  the  ACES.  It  would,  however,  generally 
increase  software  complexity  and  certification  problems.  Specifying  a  new, 
dedicated  ACES  processor  would  simplify  development  but  would  require 
additional  hardware  expense  and  engineering  to  find  space  to  house  the  unit. 

In  the  process  of  examining  the  existing  situation,  future  plans  were  examined. 
This  uncovered  a  trend  in  the  aircraft  industry  away  from  the  dedicated 
processor  and  towards  an  integrated  avionics  concept.  The  standards  for  this 
concept  are  being  developed  by  the  Airlines  Electronic  Engineering  Committee 
(AEEC)  of  Aeronautical  Radio,  Inc.  (ARINC).  ARINC  is  a  corporation  whose 
stockholders  include  the  major  U.S.  scheduled  airlines,  foreign  flag  carriers 
and  various  air  transport  companies  and  suppliers.  Through  the  AEEC,  ARINC 
formulates  standards  for  electronic  equipment  and  systems  for  the  airlines. 
These  standards  are  used  to  inform  suppliers  of  the  considered  opinions  of  the 
airline  industry. 

The  integrated  avionics  concept,  which  is  already  being  adapted  to  the  next 
generation  of  aircraft,  involves  using  a  number  of  multi-purpose  host 
processors  physically  distributed  around  the  aircraft  to  run  programs  which  will 
address  the  majority  of  avionics  needs.  Each  processing  unit  would  address 
multiple  functions.  Extremely  high  reliability  would  be  achieved  by  using  fault 
tolerant  32  bit  processors,  executive  software,  built-in  test  equipment  (BITE) 
and  standard  input/output  interfaces.  As  appropriate,  the  programs  for  a 
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particular  function,  e.g.,  flaps  and  slats  control,  could  be  run  in  parallel  on 
two  of  the  processors  for  additional  reliability. 

Under  the  integrated  approach,  specific  functions  are  accomplished  by 
preparing  implementing  software  in  a  common  language.  The  present  AEEC 
thinking  calls  for  the  preparation  of  that  software  in  the  Ada  language.  Ada 
was  developed  by  the  U.S.  Governmeni,  Department  of  Defense,  which  now 
requires  its  use  for  all  software  in  new  weapons  systems  (Aviation  Week  & 
Space  Technology,  March  28,  1988). 

Ada  has  been  used  to  implement  avionics  systems  on  a  variety  of  aircraft 
including  the  Northrop  F-20  fighter  and  the  Beech  Starship.  Developmental 
problems  with  early  Ada  compilers  have  largely  been  solved.  Therefore,  Ada  is 
considered  a  good  choice  for  future  avionics  development  because  the  code  is 
simple  to  maintain  and  modules  can  be  easily  reused  for  new  applications. 

Once  the  integrated  concept  is  implemented,  most  of  the  existing  dedicated 
processors  will  be  replaced  by  compiled  programs  running  on  common  processors 
and  managed  by  an  executive  routine.  For  example,  the  FMC  would  be  coded 
in  Ada  software,  compiled  and  run  on  several  of  the  processors.  Input  data 
for  the  programs  would  be  obtained  from  a  digital  data  bus  which  would  also 
receive  outputs  which  had  to  be  passed  from  one  program  to  another. 

A  complete  description  of  the  integrated  avionics  concept  is  beyond  the  scope  of 
this  report.  Moreover,  it  is  presently  only  a  proposed  design  which  will  evolve 
extensively  before  it  is  used  in  a  commercial  transport.  Its  significance  in  the 
context  of  an  ACES  system  is  that  future  transports  will  already  possess  the 
supporting  hardware  needed  to  implement  an  ACES.  In  essence,  the  ACES  logic 
would  function  as  a  program  on  one  or  more  of  the  processors.  This  program 
would  receive  inputs  from  sensors  appropriately  . deployed  around  the  fuselage. 
The  sensor  output  could  either  be  wired  directly  to  the  ACES  processor  or 
converted  to  a  digital  signal  at  the  nearest  computer  and  distributed  to  the 
ACES  processor  on  the  data  bus. 

The  industry  trend  to  the  integrated  avionics  concept  provides  a  clear  path  to 
support  ACES  on  future  aircraft.  Current  design  thinking  among  AEEC 
members  is  that  there  will  be  considerable  spare  processing  capacity  in  the  host 
computers.  Therefore,  ACES  can  be  readily  accommodated.  The  hardware  and 
software  computing  needs  of  an  ACES  system  as  envisioned  in  this  study  will 
have  to  be  met  by  an  Ada  program  if  the  system  is  to  be  integrated  into  future 
aircraft . 

HUMAN  FACTORS  AND  CREW  WORKLOAD  ANALYSIS.  ACES  must  function  as  a 
human-machine  system.  As  such,  it  is  not  necessarily  intended  to  replace  crew 
functions,  but,  rather,  to  support  them  by  providing  accurate,  reliable 
information  in  a  timely,  easily  assimilated  way.  The  problem  analysis  suggested 
that  the  crew  needed  assistance  in  several  areas  including  receiving  and 
interpreting  warnings,  retrieving  checklist  information  and  following 
procedures.  In  addition,  the  ACES  would,  by  definition,  interact  with  the  crew 
during  times  of  high  stress  and  workload  after  a  fire  had  been  detected. 
Therefore,  the  ACES  should  be  designed  to  reduce  the  additional  workload 
inherent  in  responding  to  the  emergency  as  much  as  is  consistent  with  an 
effective  allocation  of  functions  between  the  crew  and  automated  systems. 
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In  order  to  determine  the  crew  interface  needs  of  an  ACES  system,  analyses  of 
existing  and  contemplated  warning  and  crew  response  systems  were  undertaken. 
These  were  accomplished  by  a  literature  review,  referencing  the  flight  crew 
operating  manuals  of  the  airlines  and  airframe  manufacturers,  discussions  with 
pilots  and  human  factors  specialists  and  direct  observation  in  the  cockpits  of 
existing  aircraft. 

The  modern  aircraft  cockpit  contains  an  abundance  of  alerts  and  warnings 
intended  to  direct  the  attention  of  the  crew  to  information  which  is  important  to 
the  safe  and/or  efficient  progress  of  the  flight.  In  most  newer  aircraft,  these 
alerts  and  warnings  are  handled  by  one  or  more  flight  warning  computers 
(FWCs)  which  collect  status  information  from  sensors,  apply  appropriate  decision 
rules  and  activate  the  specified  alert  or  warning  signal. 

Overall,  the  vast  majority  of  cockpit  alerts  and  warnings  are  presented  to  the 
crew  through  auditory  and/or  visual  modalities.  The  one  common  tactile 
warning,  the  stick  shaker  which  signals  an  approach  to  a  stall,  will  disappear 
as  more  aircraft  adopt  sidestick  fly-by-wire  control  systems  with  inherent  stall 
protection . 

The  current  presentation  of  warnings  and  the  contemplated  approach  for  the 
next  generation  of  aircraft  follows  the  master  warning  concept.  Under  this 
concept,  the  existence  and  degree  of  problem  is  indicated  through  an  auditory 
signal,  and  the  specific  nature  of  the  problem  is  presented  visually.  In  older 
aircraft,  the  pilots  must  often  scan  a  variety  of  instruments  and  indicators 
throughout  the  cockpit  to  localize  the  cause  of  the  warning.  The  current  and 
contemplated  generations  of  cockpit  design  employ  electronic  centralized 
monitoring  cathode  ray  tube  (CRT)  displays  to  reduce  the  amount  of  visual 
scanning  required  to  localize  a  fault.  The  Airbus  Industrie  Electronic 
Centralized  Aircraft  Monitor  (ECAM)  system  on  the  A310,  A300-600  and  A320 
and  the  Boeing  Engine  Indication  and  Crew  Alerting  System  (EICAS)  on  the 
767,  757  and  747-400  are  examples  of  the  centralized  monitoring  concept.  Both 
of  these  systems  employ  computers  to  monitor  the  information  from  sensors 
throughout  the  aircraft  and  to  establish  the  various  alert  or  warning  conditions. 

In  addition  to  assisting  the  pilots  in  localizing  the  reason  for  a  warning  or 
alert,  centralized  monitoring  systems  also  provide  some  alerts  and  warnings 
directly  without  associated  auditory  alerting  signals.  The  problems  highlighted 
in  this  manner  are  typically  less  critical  than  those  which  are  coupled  with  an 
auditory  warning.  An  example  would  be  brake  temperatures  which  are  high  but 
not  critical.  The  use  of  color  CRT  displays  in  the  centralized  systems  makes  it 
possible  to  indicate  alerts  through  a  change  of  color.  The  typical  paradigm  is 
to  show  values  within  the  normal  range  in  green,  those  approaching  a  critical 
value  or  trending  towards  out  of  range  levels  in  amber  and  actual  out  of  range 
values  in  red.  In  order  to  provide  a  rapid  differentiation  between  warning  and 
system  status  messages,  the  ECAM  and  EICAS  under  normal  operations  dedicate 
one  CRT  as  a  warning  display  and  the  other  as  a  system  display. 

The  actual  alert  or  warning  presentation  is  a  function  of  the  criticality  of  the 
situation,  the  response  time  requirements  imposed  on  the  pilots  and  the  number 
of  correct  response  modalities.  Minor  alerts,  such  as  the  loss  of  a  redundant 
system,  are  typically  displayed  by  amber  warning  lights  or  a  message  on  the 
warning  display  CRT.  Moderate  alerts,  such  as  the  cockpit  intercom  or  the 
altitude  alert  which  indicates  that  the  aircraft  is  nearing  a  preset  altitude  after 
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climb,  are  usually  signalled  by  a  single  chime.  In  the  case  of  the  altitude 
alert,  this  chime  is  typically  coupled  with  a  signal  light  on  the  control  panel. 
For  all  minor  alerts,  however,  the  chime  tone  is  relatively  mild  compared  with 
other  cockpit  warnings. 

Alerts  and  warnings  of  the  most  serious  nature  are  usually  signalled  by  a  more 
insistent  chime  or  horn  sound,  such  as  a  continuous  repetitive  chime  for  an 
engine  fire  or  a  "cavalry  charge"  for  an  autopilot  failure,  and  confirmed  by  a 
visual  display. 

Some  alerts  and  warnings  are  not  readily  adaptable  to  the  master  warning 
concept.  For  example,  when  the  available  response  time  for  the  crew  is 
extremely  limited  or  the  crew’s  attention  must  be  focused  on  a  particular 
instrument  or  out  of  the  windscreen,  there  is  not  sufficient  time  for  scanning 
the  cockpit  or  centralized  monitor  and  reaching  a  decision.  These  critical  alerts 
and  warnings  are  therefore  presented  using  a  voice  synthesizer.  The  message 
can  be  an  immediate  command  to  action  as  in  the  "PULL  UP"  call  from  the 
ground  proximity  warning  system  (GPWS).  It  can  also  be  a  critical  advisory 
such  as  the  "GEAR  IS  UP"  message  when  the  aircraft  enters  a  final  approach 
configuration  and  the  landing  gear  has  not  been  deployed. 

Advances  in  synthetic  voice  technology  have  permitted  its  use  as  a  routine 
alert.  In  particular,  synthetic  voice  alerts  are  beginning  to  see  widespread  use 
in  new  cockpits  (e.g.,  the  A3 10)  to  replace  routine  information  calls  from  the 
nonflying  pilot  to  the  flying  pilot.  These  include  calling  the  radio  altitude  on 
final  approach,  indicating  the  acquisition  of  the  glide  slope  and  noting  passage 
of  the  aircraft  over  the  approach  markers.  The  automation  of  these  routine 
alerts  frees  the  nonflying  pilot  for  other  cockpit  duties  including  "heads  up” 
views  from  the  aircraft  to  check  for  traffic. 

In  general,  the  modern  cockpit  has  sufficient  warning  capability  to  accommodate 
additional  ACES-related  indications.  The  critical  design  issue  is  to  select  a 
warning  modality  and  specific  warning  format  which  are  consistent  with  existing 
practice,  the  ACES  mission  and  the  likely  scenarios  under  which  an  ACES 
system  will  come  into  operation. 

The  latest  warning  systems,  such  as  the  Airbus  Industrie  second  generation 
ECAM  in  the  A320,  go  beyond  issuing  a  warning  and  identifying  the  fault. 
They  also  present  the  corrective  checklist  and  a  synoptic  view  of  the  failed 
system.  For  example,  when  cargo  compartment  smoke  is  detected  by  the 
sensors  on  the  Airbus  A310-300,  a  continuous  rapid  chime  is  sounded.  At  the 
same  time,  the  identification  of  the  problem  and  the  corrective  checklist  appear 
on  the  warning  display  (left  CRT).  The  system  display  (right  CRT)  shows  a 
schematic  of  the  air  conditioning  system  indicating  the  positions  of  the  air  flow 
valves  for  the  involved  compartment  (they  close  automatically)  and  the  measured 
compartment  temperatures . 

Further  extensions  of  the  current  warning  concepts  have  been  examined  by 
Boucek  et.  al.  (1985).  In  addition  to  a  separate  alerting  display,  they  also 
evaluated  various  means  by  which  the  pilot  could  accomplish  the  displayed 
checklist  items  including  voice  and  touch  control,  multifunction  keyboards  and 
automatic  systems.  They  concluded  that  the  choice  of  control  system  affected 
the  performance  of  the  entire  flight  status  monitoring  system.  They  also 
indicated  that  the  pilots  they  used  as  subjects  preferred  automated  approaches 
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but  were  concerned  about  the  reliability  of  systems  which  would  bypass  their 
decision-making  and  apply  countermeasures. 


Discussions  with  airline  and  industry  personnel  in  this  study  suggested  that  the 
ACES  warning  subsystem  should  operate  in  much  the  same  fashion  as  those  on 
the  latest  generation  of  aircraft.  They  also  expressed  concern  with  the 
reliability  of  fully  automated  systems.  Moreover,  in  the  context  of  an  ACES  for 
in-flight  fires,  they  saw  little  benefit  to  automating  the  application  of 
countermeasures.  There  was,  however,  a  strong  sentiment  that  a  system  which 
executed  the  checklist  items  at  the  pilot's  command  would  be  beneficial.  This 
approach  eliminates  the  need  for  the  crew  to  locate  the  appropriate  control  for  a 
particular  action.  It  could  also  be  implemented  in  combination  with  an  "audit" 
system  which  would  verify  that  all  of  the  checklist  items  had  been  performed 
and  warn  the  crew  if  an  item  had  been  omitted. 

The  results  of  the  human  factors  and  crew  workload  analysis  indicated  that 
radical  departures  from  the  current  approach  were  generally  not  warranted  nor 
were  they  acceptable  to  flight  crews.  Thus,  the  ACES  interface  with  the  crew 
could  best  be  modeled  after  the  current  generation  of  high  automation  aircraft. 

SCENARIO  DEVELOPMENT. 

The  preceding  parts  of  this  Section  have  described  four  distinct  analyses  which 
produced  information  and  guidance  for  the  definition  of  the  ACES  concept. 
They  also  produced  data  required  to  develop  the  scenarios.  The  process  of 
scenario  development  is  described  below. 

SOURCES.  This  technology  assessment  was  concerned  primarily  with  the 
in-flight  fire  threat  (other  than  engine,  and  lifting  and  control  surfaces)  as  it 
exists  in  today's  air  transport  system.  While  this  threat  may  change  in  the 
future  with  changes  in  aircraft  size  and  configuration,  varying  route  structures 
and  other  system  characteristics,  the  focus  was  on  today's  threat.  If  an  ACES 
technology  can  be  shown  to  cope  effectively  with  today's  threat,  it  is 
reasonably  likely  that  the  technology  can  be  adapted  to  meet  future  variations. 
Thus,  the  in-flight  fire  scenarios  developed  for  this  study  were  selected  to  be 
representative  of  today's  problem.  The  most  significant  sources  for  such 
scenarios  were  the  reports  of  actual  in-flight  fire  or  smoke  events  made  by 
NTSB,  FAA  and  the  airlines  themselves.  One  earlier  research  report  on 
aircraft  ventilation  (Lorengo  and  Porter,  1986)  contained  fire  and  smoke 
scenarios  that  were  also  useful  in  this  study. 

The  study  staff,  using  input  from  FAA  as  well  as  from  airline  personnel  and 
their  own  knowledge  of  air  transport  and  fire  development,  created  scenarios 
which  are  realistic  and  plausible  and  encompass  a  variety  of  outcomes.  The 
scenarios  include  false  alarms  as  well  as  totally  catastrophic  fires.  Also,  the 
crew  responses  range  from  poorly  handled  tragedies  to  models  of  appropriate, 
fully  correct  emergency  procedures.  The  set  cannot,  of  course,  be  claimed  to 
be  exhaustively  complete.  !t  is,  however,  broadly  representative  of  the 
in-flight  events  that  have  recently  occurred  and  could  be  experienced  today. 

In  all,  13  scenarios  were  developed  and  used  in  this  study;  each  of  these 
was  developed  in  a  way  that  shielded  actual  events  from  identification.  Aircraft 
types  were  not  identified  and  no  corporate  or  individual  names  were  used. 
There  are  four  scenarios  adapted  directly  from  actual  events.  These  describe 
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the  events,  the  procedures  followed  by  the  crew  and  all  other  details  exactly  as 
contained  in  the  investigative  reports.  These  scenarios  are  presented  in 
different  settings  to  make  them  anonymous.  The  extensive  investigations  which 
surrounded  these  four  events  provided  a  rich  source  of  scenario  data  which  was 
considered  to  be  extremely  valuable  to  these  analyses. 

The  remaining  nine  scenarios  depict  situations  derived  from  actual  events  or 
from  concerns  of  industry  personnel  contacted  during  the  study.  Because 
these  incidents  typically  had  less  catastrophic  outcomes  than  the  first  four, 
there  were  no  detailed  investigations.  Therefore,  the  event  sequences  for 
these  scenarios  were  developed  based  on  the  type  of  aircraft  and  the  flight 
characteristics  postulated.  The  crew  procedures  in  these  scenarios  were 
written  to  be  consistent  with  the  aircraft  type  and  with  the  nature  of  the 
event.  Some  plausible  errors  were  introduced  to  broaden  the  basis  of 
evaluation  of  both  the  ACES  and  the  non-ACES  systems.  The  particular 
situations  were  selected  to  illustrate  potential  fire  or  smoke  incidents  not 
addressed  in  the  other  scenarios. 

SCENARIO  APPLICATION.  In  the  conceptualization  and  in  the  implementation  of 
this  study,  the  fire  scenarios  were  the  vehicle  by  which  the  assessment  and 
evaluation  tasks  were  performed.  Scenario  development  began  with  the 
preparation  of  a  generic  outline  of  scenario  content.  The  outline  was  designed 
to  capture  sufficient  detail  of  the  incident  and  of  the  crew  response  and  to 
allow  a  valid  assessment  of  the  ACES  concept.  This  was  followed  by  the 
enumeration  of  candidate  scenarios  from  which  a  final  list  of  13  fire/ smoke 
incidents  was  compiled.  Even  though  the  study  contract  stipulated  that  only  10 
scenarios  would  be  developed,  it  was  concluded  that  the  13  incidents  provided  a 
more  complete  scope  to  the  study.  Thus,  the  first  application  of  the  scenarios 
was,  in  effect,  to  define  the  bounds  of  the  study.  Even  before  the  contents  of 
a  single  scenario  had  been  written,  the  specified  outline  of  a  scenario 
description  and  the  selected  incidents  established  both  the  scope  and  depth  of 
the  study. 

As  the  study  progressed,  the  staff  completed  drafts  of  each  of  the  scenarios 
which  were  used  to  facilitate  discussions  with  FAA  air  transport  and  airframe 
manufacturing  personnel.  In  this  application,  the  scenarios  were  reviewed  and 
refined,  but,  more  importantly,  they  served  to  stimulate  creative  thinking  about 
the  concept  of  an  ACES  as  well  as  about  the  potential  technologies.  The 
scenarios  served  as  vehicles  for  testing,  refining  and  revising  possible  ACES 
concepts  and  technologies.  This  was  an  iterative  process  in  which  all  of  the 
study  participants  took  part. 

At  the  end  of  this  phase,  the  scenarios  had  evolved  to  a  final  form  in  which 
each  incident  and  the  crew’s  responses  were  realistically  and  completely 
defined.  At  this  point  in  the  study,  the  scenarios  were  used  as  a  basis  for 
describing  a  timeline  sequence  of  events  and  responses  in  each  incident  and  the 
effects  of  each  event  and  response.  This  was  done  for  the  present  fire 
detection  warning  and  systems  and  the  present  response  systems,  i.e.,  a 
non-ACES  system.  A  similar  analysis  was  then  performed  applying  the  ACES 
concept.  Using  the  results  of  these  two  analyses,  a  determination  was  made  of 
the  potential  operational  benefits  and  limitations  and  the  methods  of  employment 
of  an  ACES  system. 
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The  scenario  analyses  were  structured  to  reflect  a  simple,  generic  model  of  four 
processes  considered  to  be  common  to  dealing  with  any  in-flight  fire  or  smoke 
event:  detection,  localization,  identification,  and  evaluation  /action.  Evaluation 
is  further  divided  into  risk  assessment  and  countermeasures  identification. 
Action  includes  countermeasure  selection  and  implementation.  The  analysis  of 
each  scenario  resulted  in  a  record  of  the  time  required  to  complete  each  of  the 
four  processes  and  a  qualitative  assessment  of  each  process.  Finally,  the 
opportunities,  and  possibly  the  means,  for  improving  these  processes  were 
identified.  A  comparison  of  the  analyses  with  and  without  an  ACES  system 
across  all  of  the  defined  scenarios  provides  a  direct  assessment  of  the  potential 
benefits  of  an  ACES  system. 

A  brief  description  of  each  process  and  its  analysis  follows  in  order  to  provide 
the  reader  with  the  context  for  interpreting  the  scenarios  and  their  associated 
analyses . 

Detection .  Detection  is  the  means  by  which  the  Flight  Deck  Crew  becomes 
aware  of  each  event  as  the  incident  develops.  In  present  aircraft,  fire  and 
smoke  detection  can  be  by  automatic  means  such  as  a  thermal  or  a  smoke 
detector  or  it  can  be  accomplished  by  a  human  sensor  such  as  a  crew  member 
or  passenger.  Under  the  ACES  concept,  automated  detection  is  emphasized. 
Detection  of  other,  circumstantial  evidence  which  can  be  used  to  discriminate 
real  fires  from  false  alarms  and  accelerate  the  detection  process  are  also 
considered.  The  major  criteria  for  detection  concern  the  time  required  as  well 
as  the  quality  of  the  information  returned.  Essentially  this  reduces  to  the 
speed  and  accuracy  of  detection. 

Localization.  Localization  in  the  fire  model  has  to  do  with  determining  the 
source  of  the  fire  or  smoke.  This  determination  of  where  the  incident  is 
located  and  of  its  fuel  source  are  critical  factors  for  the  subsequent  processes 
of  Identification  and  Evaluation.  The  timeliness  of  localization  relative  to  the 
rate  of  fire  development  and  the  accuracy  of  position  determination  and  fuel 
source  are  the  major  analysis  issues. 

Identification .  The  identification  process  includes  determination  of  whether 
the  evinFiiTtruIy  a  fire/smoke  event  or  is  a  false  alarm  as  well  as  identification 
of  the  type  of  fire  and  the  stage  of  fire  development.  Analysis  relative  to 
identification  is  concerned  with  how  quickly  and  accurately  the  nature  of  the 
event  is  made  known  to  the  crew. 

Evaluation/ Action .  In  the  generic  model,  this  process  has  to  do  first  with 
risk  assessment :  what  is  the  danger  to  aircraft  and  to  persons  on  board?  The 
process  then  deals  with  countermeasures  identification,  selection  and 
implementation.  Countermeasures  include  fire  suppression  as  well  as  control  of 
crew  and  passengers  and  aircraft  control  and  maneuvering.  The  analysis  of 
this  area  is  concerned  with  the  timeliness  of  the  evaluation  as  well  as  the 
appropriateness  of  countermeasure  identification,  selection  and  implementation. 
The  ultimate  criterion  in  this  area  is  the  extent  to  which  the  countermeasure 
produced  a  timely  and  safe  resolution  of  the  incident. 

Each  of  the  analytical  steps  just  described  played  an  important  role  in  the 
outcome  of  this  study.  The  information  obtained  was  used  throughout  the 
effort  as  input  to  decision-making  and  for  validity  testing.  The  initial  product 
of  the  integration  of  the  findings  was  a  description  of  the  characteristics  of  an 
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ACES  system  which  could  be  used  to  assess  the  feasibility  of  the  concept. 
These  characteristics  are  presented  below. 


AN  ACES  SYSTEM 


The  analyses  showed  clearly  that  the  ACES  system  concept  used  for  feasibility 
testing  should  be  computer-based  because  of  the  required  amount  of  processing 
and  the  need  for  rapid  response.  Further,  remote  sensing  should  be  included 
because  of  the  large  amount  of  inaccessible  volume  in  the  fuselage  which  must 
be  protected.  Thus,  for  this  analysis,  ACES  is  conceptualized  as  a 
person-machine  system  consisting  of  hardware  and  software.  This  ACES  system 
is,  in  turn,  a  subsystem  of  the  total  avionics  suite  on  a  commercial  aircraft. 

The  hardware  and  software  characteristics  of  the  proposed  ACES  system 
configuration  are  presented  below.  The  hardware  is  grouped  into:  Sensor, 
Data  Input,  Processor,  and  Control  and  Display.  Every  attempt  has  been  made 
to  insure  that  the  concepts  included  here  are  realistic  with  respect  to  the  state- 
of-the-art  and  in  keeping  with  current  and  contemplated  industry  practices.  It 
must  be  noted,  however,  that  this  was  a  technology  assessment  and  not  a 
design  study.  Thus,  some  of  the  ACES  system  characteristics  described  here 
may  not  be  the  most  cost-effective  way  to  achieve  the  desired  functionality. 
Further,  certain  detailed  system  design  features,  such  as  the  exact  number  and 
placement  of  sensors  within  an  aircraft,  remain  to  be  determined. 

HARDWARE . 

The  ACES  system  will  include  a  battery  of  primary  sensors,  other  data  inputs, 
computer  processing  and  a  crew  interface.  Each  of  these  aspects  is  described 
below . 

SENSORS.  The  ACES  system  will  employ  "primary"  sensors,  i.e.,  sensors 
whose  only  function  is  to  detect  fire  and  smoke  incidents.  In  order  to  specify 
the  sensor  requirements  of  the  system,  it  is  necessary  to  list  the  types  of  fire 
signatures  to  be  used,  the  nature  of  the  sensor  outputs  and  the  possible 
locations  of  sensors  throughout  the  fuselage.  Two  signatures  appear  to  be  best 
suited  for  consideration  in  ACES,  the  invisible  aerosol  signature  (particles  less 
than  0.3  micrometers)  and  the  convected  energy  signature. 

The  aerosol  signature  was  selected  because  the  small  particles  are  produced  in 
both  smoldering  and  flaming  fires  and  are  generated  early  and  in  large 
quantities  in  rapidly  growing  fires,  which  are  the  ones  with  the  most  urgency. 
The  best  aerosol  sensors  for  this  purpose  are  spot  devices  using  xenon  light 
sources,  ionization  chambers  or  particle  counters. 

The  convected  energy  signature  was  selected  because,  like  smoke,  fire  gases 
and  hot  air  rise  and  move  throughout  a  space  and  tend  to  accumulate  at  the 
highest  part  of  the  monitored  space  where  sensors  can  easily  detect  temperature 
changes.  These  temperature  sensors  are  also  desirable  because  they  can  detect 
the  propagation  of  energy  in  adjacent  spaces  thereby  providing  an  additional 
validity  test  for  the  presence  of  a  fire. 
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Inherent  in  the  proposed  sensor  deployment  is  the  capability  to  combine 
information  about  multiple  fire  signatures  for  greater  confidence  in  the  alarm 
indications.  A  rapid  increase  in  aerosol  concentration  with  a  decrease  in  air 
temperature  is  much  less  likely  to  denote  a  fire,  for  example,  than  is  a  rapid 
increase  in  both  signatures. 

The  sensors  specified  for  the  ACES  system  must  respond  rapidly  and 
predictably  to  changes  in  signature  levels.  The  hardware  must  be  physically 
robust  and  capable  of  meeting  all  applicable  standards  and  specifications. 

Analog  outputs  from  the  both  aerosol  ("smoke")  and  convected  energy  ("heat") 
sensors  are  required.  Analog  information  is  essential  in  order  to  achieve  the 
degree  of  intelligence  needed  to  overcome  many  of  the  problems  inherent  in  the 
trade-off  between  rapid  detection  and  high  false  alarm  rates.  The  benefits  of 
the  analog  sensor  output  can  best  be  seen  through  a  brief  discussion  of  the 
relative  quality  of  information  from  sensors  with  binary  (fire/ no-fire)  outputs 
and  those  with  analog  (continuous  data  value)  outputs.  The  following 
discussion  will  develop  a  set  of  fire  or  non-fire  conditions  that  could  be 
inferred  from  a  given  type  of  fire  sensor  signals  or  sensor  conditions.  It  will 
be  assumed  that  both  heat  and  smoke  sensors  housed  in  a  single  unit  will  be 
present  in  the  area  being  monitored. 

Two  approaches  will  be  compared.  The  first  will  assume  that  the  information  is 
presented  in  a  binary  format,  i.e.,  threshold  heat/no  heat  or  threshold 
smoke /no  smoke.  It  is  assumed  that  the  alarm  will  actuate  for  each  sensor 
when  a  predetermined,  fixed  aerosol  concentration  or  air  temperature  threshold 
is  reached,  and  that  the  threshold  levels  are  consistent  with  current  aviation 
practice.  While  the  determination  of  the  optimum  thresholds  is  beyond  the 
scope  of  the  current  effort,  it  is  one  of  the  most  important  and  challenging 
tasks  for  a  detailed  design  study. 

The  second  approach  will  assume  continuous  monitoring  of  the  instantaneous 
aerosol  and  heat  levels.  Because  the  sensor  outputs  will  be  analog,  data  about 
the  rate  of  change  of  smoke  and  heat  can  be  derived.  In  the  analog  system,  it 
will  be  assumed  that  a  maximum  or  "redline"  smoke  or  heat  condition  can  be 
defined  that  would  indicate  an  automatic  "emergency"  sensor  condition.  For  the 
purpose  of  this  example,  the  redline  conditions  will  be  assumed  to  be  fixed  at 
the  same  value  as  current  aviation  smoke  and  heat  detection  thresholds.  The 
discussion  of  software  later  in  this  Section  will  introduce  the  concept  of  variable 
thresholds  as  proposed  for  the  ACES  implementation. 

Considering  the  first  approach,  there  are  four  possible  sensor  conditions  that 
can  arise  from  combined  binary  format  smoke  and  heat  sensor  systems.  These 
are  shown  as  a  matrix  one  the  following  page.  The  cells  are  defined  by  the 
presence  or  absence  of  heat  or  smoke  at  a  predetermined,  fixed  threshold  level. 
As  is  customary  in  existing  systems,  these  thresholds  would  likely  be  set  quite 
high  to  avoid  excessive  false  alarms.  The  cells  for  each  sensor  condition  are 
numbered  from  one  to  four  for  reference  in  the  following  discussion. 

In  Condition  1,  the  presence  of  both  aerosol  and  heat  at  threshold  levels  is 
indicated.  In  this  condition,  it  is  most  likely  that  a  fire  exists  which  is 
producing  both  smoke  and  flame  and  is  rapidly  growing.  At  this  point,  the 
body  of  flame  may  be  either  small  or  large.  If  both  the  heat  and  smoke  alarms 
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activate  at  the  same  time,  conditions  are  likely  to  be  worse  than  if  there  is  a 
delay  between  the  smoke  and  heat  alarms. 


THRESHOLD 

HEAT 

NO  HEAT 

THRESHOLD 

SMOKE 

1 

2 

NO  SMOKE 

3 

4 

It  is  possible  but  highly  unlikely  that  malfunction  of  the  aircraft  heating  system 
controls  combined  with  a  particulate  source  such  as  overheated  electrical 
insulation  could  produce  the  same  sensor  condition.  If  such  a  malfunction  were 
to  occur,  it  could  not  be  differentiated  from  a  real  fire  by  this  detection 
system . 

Under  Sensor  Condition  2,  there  is  threshold  smoke  with  heat  below  threshold. 
A  slowly  developing  smoldering  fire  or  a  fire  developing  in  a  closed  or  partially 
closed  container  could  produce  smoke  aerosol  without  releasing  sufficient  heat  to 
reach  threshold  and  trigger  an  alarm.  A  fire  may  also  be  developing  in  an  area 
where  there  are  no  sensors  and  the  smoke  has  cooled  to  a  temperature  below 
the  heat  threshold  and  migrated  into  a  monitored  area.  Overheated  electrical 
insulation  can  also  produce  large  volumes  of  aerosol  at  detectable  levels  without 
significantly  heating  the  local  environment.  Depending  on  the  nature  of  the 
electrical  fault,  a  'ire  may  or  may  not  result.  A  non- fire  possibility  could 
result  from  rapid  cooling  of  high  humidity  air  resulting  in  condensation  (fog) 
aerosol,  a  known  source  of  false  alarms  in  smoke  sensors. 

The  presence  of  threshold  heat  without  threshold  smoke  is  indicated  by  Sensor 
Condition  3.  It  is  difficult  to  imagine  a  real  fire  scenario  that  would  lead  to 
this  sensor  condition  if  the  sensors  are  co-located  unless  the  aerosol  sensor  is 
not  functioning.  While  some  fuels  like  alcohol  and  butane  will  burn  with  little 
aerosol  production,  this  only  occurs  in  the  absence  of  other  burning  materials, 
an  unlikely  situation. 

Sensor  Condition  4  implies  that  neither  aerosol  nor  heat  are  present  at 
threshold  levels  and  would  normally  be  interpreted  as  a  no-fire  condition.  If  a 
fire  were  present,  it  would  be  producing  aerosols  and  heat  at  levels  that  would 
not  raise  the  ambient  aerosol  concentration  or  air  temperature  to  the  alarm 
threshold.  Therefore,  the  sensor  battery  would  provide  no  clues  that  a  fire 
existed.  These  situations  are  characteristic  of  the  early  stages  of  a  fire  that 
will  eventually  trigger  an  alarm  or  an  extremely  small  fire  that  never  grows 
significantly. 

In  contrast  to  the  above,  the  second  sensor  approach  involves  the  use  of  analog 
sensor  outputs  interpreted  by  an  intelligent  program.  Continual  monitoring  of 
analog  outputs  will  provide  the  information  needed  to  permit  determination  of 
the  rate  of  change  of  both  smoke  aerosol  concentration  and  air  temperature.  It 
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would  permit  measuring  the  levels  of  smoke  and  heat  over  time  and  to  determine 
if  they  were  trending  upward  (had  a  positive  slope). 


To  illustrate  this  sensor  approach,  the  added  information  it  provides  can  be 
integrated  into  a  matrix  similar  to  the  one  used  earlier.  This  second  matrix 
contains  nine  cells  lettered  A  through  I  and  is  shown  below.  The  nine  cells  are 
derived  from  three  conditions  of  each  sensor.  These  are  a  redline  or  threshold 
level,  an  established  positive  slope  or  increasing  condition  and  a  "flat"  output 
(no  heat  or  no  smoke  change  from  ambient). 


REDLINE 

HEAT 

INCREASING 

HEAT 

NO  HEAT 

REDLINE 

SMOKE 

A 

B 

C 

INCREASING 

SMOKE 

D 

E 

F 

NO  SMOKE 

G 

H 

1 

Condition  A  has  both  sensors  at  the  redline  level.  This  is  functionally 
equivalent  to  Sensor  Condition  1  described  above  for  the  binary  sensor 
approach.  It  almost  surely  indicates  that  a  serious  fire  is  in  progress  with 
active  flaming  and  smoke  production. 

In  Sensor  Condition  B,  smoke  is  at  redline  and  heat,  although  not  at  redline,  is 
increasing.  If  the  rate  of  heat  increase  is  slow,  there  may  be  either  a 
smoldering  fire  in  the  compartment  in  question  or  a  fire  developing  remotely 
with  the  smoke  preceding  the  heat.  If  the  heat  is  rising  rapidly,  it  is  likely 
that  the  fire  is  actively  flaming  and  in  the  same  compartment  or  area  as  the 
sensor  unit. 

Sensor  Condition  C  would  not  likely  represent  a  fire  other  than  one  of  a 
smoldering  nature.  The  aerosol  that  is  present  night  be  condensation  or 
moisture,  as  discussed  before,  or  possibly  from  leaks  of  refrigerants,  hydraulic 
fluid  under  high  pressure  or  a  ruptured  aerosol  container.  Under  these 
conditions  there  would  be  no  temperature  rise  expected.  With  the  smoke  at 
redline,  however,  there  still  would  be  cause  for  concern.  If  there  were  a  real 
smoldering  fire,  the  temperature  would  eventually  begin  to  rise  and  Sensor 
Condition  B  would  be  reached.  If  the  heat  sensor  data  indicates  that  the 
temperature  in  the  compartment  has  dropped  below  the  dew  point  of  air  at  the 
last  airport,  the  conflict  could  be  resolved  negatively.  If  the  condition  changes 
from  no-smoke  to  redline  instantaneously  with  no  heat,  the  indication  is  likely 
the  result  of  a  smoke  sensor  short  rather  than  a  real  condition. 

Sensor  Condition  D  could  indicate  overheated  equipment  approaching  the  point 
of  flame  production  or  perhaps  only  reaching  temperatures  sufficient  to  char  or 
scorch  materials  but  not  ignite  them.  Heat  at  the  redline  would  suggest  a 
serious  cause  for  concern  and  would  almost  certainly  dictate  an  emergency 
response. 


Indications  of  both  increasing  smoke  and  heat  as  in  Condition  E,  are  a  very 
strong  evidence  of  fire.  Flaming  has  most  likely  begun.  If  either  sensor  is 
indicating  rapid  rate  of  increase,  the  situation  is  likely  quite  critical.  Even  a 
relatively  slow  increase  of  both  smoke  and  heat,  however,  would  be  an  early 
indication  of  a  serious  problem. 

Sensor  Condition  F  would  indicate  either  no  fire  or  the  very  early  stages  of  the 
smoldering  fire  associated  with  Sensor  Condition  C. 

Sensor  Condition  G  is  not  likely  to  be  a  fire  and  might  best  be  considered  an 
overheat  warning.  It  is,  nonetheless,  a  serious  situation  because  of  the  extent 
of  heat  involved.  A  known  malfunction  of  a  heating  system  or  other  heat 
generating  equipment  would  be  an  adequate  explanation  for  the  existence  of  this 
condition. 

Increasing  heat  in  the  absence  of  smoke  would  not  necessarily  associate  a  fire 
with  Sensor  Condition  H.  This  condition  could  indicate  the  early  stages  of 
equipment  failure  or  perhaps  the  normal  temperature  rise  associated  with  a 
descent . 

Sensor  Condition  I  would  indicate  a  non- fire  status.  It  would  be  the  normal 
operating  condition. 

This  comparison  between  a  smoke/heat  sensor  battery  with  binary  indications 
and  one  with  continuously  monitored  analog  outputs  indicates  clearly  why  the 
latter  is  preferred  for  an  ACES  application.  The  combination  of  smoke  and  heat 
sensors  covers  a  wider  range  of  fire  conditions  than  either  type  alone.  The 
continuous  analog  output  when  combined  with  an  "intelligent"  processor  permits 
the  examination  and  interpretation  of  trends.  These  in  turn  can  speed  the 
identification  of  real  fires  and  help  discriminate  between  real  and  false  alarms. 

Even  though  it  is  desirable  to  use  ACES  sensors  in  smoke/heat  pairs,  it  is 
recognized  that  physical  limitations  in  certain  areas  of  the  fuselage  and  economic 
constraints  might  preclude  the  universal  adoption  of  this  approach.  In  fact, 
without  detailed  cost-benefit  and  reliability/ maintainability  studies  which  were 
beyond  the  scope  of  the  present  effort,  final  decisions  on  the  number  and 
location  of  ACES  sensors  are  not  possible.  This  study  did,  however,  examine 
candidate  locations  for  sensors.  In  the  discussion  which  follows,  the  relative 
frequency  of  occurrence  of  fire  or  smoke  events  in  various  aircraft  areas  is 
based  on  data  provided  by  Starrett  et  al.  (1976). 

The  type  and  number  of  sensors  which  are  reasonable  to  use  in  a  given  aircraft 
functional  area  will  depend  upon  the  nature  of  the  fire  scenarios  expected,  the 
geometry  and  degree  of  compartmentalization  of  the  area,  the  ventilation 
parameters  and  the  flight  criticality  of  the  aircraft  equipment  exposed. 

The  following  is  a  list  of  possible  areas  in  which  ACES  fire  sensors  could 
possibly  be  installed.  Also  included  is  a  brief  description  of  the  sensors  which 
appear  best  suited  to  each  area  and  the  rationale  for  their  selection.  Some 
consideration  is  given  to  the  ACES  system  role  in  the  accessible  cabin  areas, 
however,  a  remote  monitoring  system  is  particularly  suited  to  detection  of 
incidents  in  inaccessible  areas  and  the  inclusion  of  other  areas  must  be  based 
on  such  factors  as  degree  of  risk  and  cost. 
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Galley  Areas .  Galley  areas  both  above  and  below  deck  were  the  most 
frequent  locations  of  fire /smoke  incidents.  Of  530  total  incidents  identified,  376 
were  in  the  pressurized  area  of  the  aircraft.  Thirty-nine  percent  (148 
incidents)  of  these  took  place  in  galleys  (133  in  upper  galleys  and  15  in  lower 
lobe  areas).  Galley  incidents  are  usually  of  low  severity,  but  they  often 
involve  large  amounts  of  smoke  and  require  a  diversion  of  the  flight. 

In  order  to  monitor  galley  areas,  a  smoke/ heat  battery  of  sensors  should 
be  used.  Additional  heat  sensors  might  be  located  in  critical  areas  in  or 
around  appliances  that  are  likely  to  overheat  and  cause  a  fire.  This  would 
provide  an  even  faster  response  than  could  be  obtained  from  monitoring  the 
entire  galley  area. 

Galleys  are  areas  in  which  temperature  and,  particularly,  smoke  can  be 
expected  to  vary  more  than  is  typical  for  other  parts  of  an  aircraft. 
Therefore,  the  interpretation  of  sensor  outputs  and  the  establishment  of 
redlines  for  galley  areas  would  have  to  be  based  on  special  criteria.  Since 
above-deck  galleys  are  usually  open  to  the  cabin  and  therefore  capable  of  being 
sensed  by  passengers  and  crew,  fire /smoke  detectors  could  be  thought  to  be 
unnecessary.  Industry  personnel  contacted  during  this  study  stated  the 
position  that  remote  sensing  in  upper  galley  areas  is  not  needed  and  would  not 
be  cost  effective.  This  response  may,  however,  stem  from  concern  over  the 
relatively  high  possibility  of  false  alarms  and  their  detrimental  effect  on  system 
reliability  based  on  current  fire  detection  system  performance. 

Cabin.  The  cabin  areas,  both  first  class  and  coach  combined,  were  the 
second  most  frequent  location  for  fire  incidents  with  67  (18%  of  these  in 
pressurized  areas).  Cabin  areas  are  characterized  by  a  wide  range  of  electrical 
and  electronic  equipment  ranging  from  fluorescent  light  ballasts  to  multiplexed 
entertainment  systems.  All  of  these  are  potential  sources  of  smoke  and  fire. 

In  addition,  smoking  by  passengers  can  result  in  the  ignition  of  cabin 
materials . 

The  open  cabin  areas  represent  an  extremely  large  volume  to  monitor  with 
smoke  or  heat  sensors.  Although  temperature  sensors  are  already  present  as 
part  of  the  environmental  control  system,  their  response  time  to  a  fire  event 
would  almost  certainly  be  longer  than  the  time  it  would  take  a  passenger  or 
crew  member  to  detect  an  incident.  Given  the  presence  of  human  sensors  in 
the  open  cabin  areas,  benefits  from  remote  sensing  appear  small.  Nevertheless, 
the  relatively  high  frequency  of  incidents  in  these  areas  suggests  that  the 
ACES  design  effort  should  examine  cabin  sensors.  For  the  feasibility  analyses 
in  this  study,  however,  it  was  assumed  that  open  cabin  areas  were  not  remotely 
monitored. 

Cockpit .  The  flight  station/ cockpit  was  the  third  most  frequent  location  of 
fires  within  the  pressurized  area  of  the  aircraft.  Sixty-two  incidents 
representing  16  percent  of  the  total  in  pressurized  areas  were  involved. 
Consideration  of  monitoring  the  cockpit  area  must  contend  with  two  opposing 
factors.  Since  all  or  most  aircraft  systems  are  routed  through  the  cockpit,  it 
is  a  highly  concentrated  locus  of  electronic  equipment,  much  of  which  is 
concealed  behind  the  instrument  panel.  In  addition,  the  crew  often  uses 
smoking  material  and  carries  numerous  combustibles  and  ignition  sources  such 
as  air  charts  and  cigarette  lighters.  These  factors  suggest  the  need  to  monitor 
the  cockpit  area. 
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On  the  other  hand,  one  or  more  highly  trained  crew  members  is  always 
present  on  the  flight  deck.  Hence,  an  excellent  "sensor"  is  already  available, 
and  there  is  no  need  for  additional  crew  alerting  once  an  incident  is  sensed . 

Because  of  the  extensive  amount  of  electronics  in  concealed  areas,  smoke 
and  heat  sensors  behind  the  instrument  panel  are  worthy  of  consideration. 
Since  much  of  the  concealed  space  in  question  is  cooled,  sensors  might  be 
considered  for  inclusion  in  ducts.  General  area  monitoring  of  the  cockpit  itself 
should  also  be  examined  in  any  detailed  design  study.  However,  it  is  not  likely 
that  cockpit  open  area  sensors  could  be  justified. 

Auxiliary  Power  Unit.  Auxiliary  power  units  (APUs)  are  a  frequent  source 
of  fire  and  smoke  incidents.  Together  with  other  equipment,  they  were 
involved  in  12  percent  of  the  incidents.  Depending  on  the  specific  aircraft 
design,  the  APU  may  be  totally  outside  the  pressurized  area  of  the  fuselage  or 
divided  between  pressurized  and  non-pressurized  areas. 

The  actual  APU  installation  would  dictate  the  type  and  number  of  ACES 
sensors  which  should  be  considered.  For  example,  if  the  APU  were  contained 
in  a  small,  concealed  space,  an  approach  similar  to  that  taken  in  the  cheek 
areas  (see  below)  would  be  indicated  in  addition  to  the  fire  sensors  already 
incorporated  in  the  APU.  It  is  also  worth  considering  line-type  heat  sensors 
incorporated  in  the  wiring  harnesses  leading  through  the  pressure  bulkhead. 
These  would  be  able  to  detect  overheating  prior  to  ignition. 

Air  Conditioning  Packs.  Spot  heat  and  smoke  sensors  placed  in  the 
discharge  ducts  from  air  conditioning  units  will  detect  unusual  temperature  or 
smoke  arising  from  equipment  failure.  As  with  galley  areas,  air  conditioning 
packs  will  likely  require  the  development  of  unique  alarm  signatures  because  of 
the  special  failure  modes  they  can  experience.  For  example,  as  depicted  in 
Scenario  9  of  this  study,  air  conditioning  packs  can  generate  large  amounts  of 
smoke  in  the  absence  of  fire  and  with  little  heat  production. 

Lavatories .  Lavatories  are  a  major  area  of  concern  for  several  reasons. 
First,  they  have  a  relatively  high  experience  of  incidents  (9%  of  the  data),  and 
they  have  been  associated  with  tragic  outcomes.  Second,  there  have  been  many 
reports  of  smoking  and  the  use  of  illegal  substances  involving  flame  production 
in  the  lavatory.  Third,  lavatories  house  combustible  material  including  paper 
towels  and  amenities.  These  characteristics  strongly  suggest  the  use  of  both 
heat  and  smoke  sensors.  Ceiling-mounted  smoke  sensors  would  provide  an  early 
signal  of  a  possible  fire,  as  well  as  supplemental  detection  information.  The 
heat  sensor  is  also  recommended  to  warn  against  opening  the  lavatory  door 
under  conditions  of  rapidly  rising  temperature. 

If  ACES  sensing  is  extended  beyond  area  monitoring,  spot  heat  sensors  in 
the  confined  spaces  of  the  amenities  cabinets  and  trash  receptacles  would 
provide  "localizing"  information  when  smoke  is  sensed  in  the  lavatory.  The 
relative  benefits  of  monitoring  trash  bins  instead  of,  or  in  addition  to,  the 
present  practice  of  equipping  them  with  automatic  extinguishers  is  worthy  of 
further  investigation. 

Avionics/ Computer  Bay.  The  avionics /computer  bay,  typically  located 
beneath  the  cockpit,  has  been  the  location  of  about  2%  of  the  fire  and  smoke 
incidents.  The  avionics  bay  is  a  densely  packed  area  of  electrical  and 
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electronic  equipment  and  usually  contains  the  aircraft  batteries.  Since  the 
avionics /computer  bay  contains  critical  electronic  equipment,  it  should  be 
considered  for  a  smoke/ heat  battery  of  sensors.  In  addition,  the  benefits  of 
very  early  warning  provided  by  submicron  particle  sensors  is  worthy  of 
consideration . 

Present  installations  typically  involve  ceiling  or  exhaust  duct  installations. 
This  approach  can  be  coupled  (as  in  the  Airbus  A310)  with  a  '’sniffer”  fan 
which  allows  the  crew  to  sample  the  duct  air  to  detect  the  characteristic  odor  of 
burning  insulation.  Placing  sensors  in  individual  equipment  cabinets  should  be 
assessed  in  the  design  of  an  ACES  because  they  would  provide  localizing 
information.  This  might  permit  the  crew  to  turn  off  only  the  equipment  actually 
involved  rather  than  having  to  engage  in  large-scale  load  shedding  to  stop 
smoke  generation. 

Cargo  Compartments.  Cargo  compartments,  while  they  are  the  location  of 
only  2%  of  the  incidents,  are  of  great  concern  to  a  fire  management  system. 
They  are  essentially  inaccessible  during  flight  and  thus  require  very  reliable 
sensing  and  containment  or  suppression  methods.  Moreover,  in  spite  of  the 
best  efforts  of  airlines  and  regulatory  agencies,  it  is  impossible  to  exercise 
complete  control  of  what  is  placed  in  them.  As  a  result,  incidents  in  cargo 
compartments  can  become  quite  severe  because  the  fire  may  have  time  to  grow 
and  spread  before  it  is  detected  and  the  compartments  may  contain  highly 
flammable  material. 

Cargo  compartments  are  a  prime  candidate  for  the  use  of  the  dual 
smoke/ heat  battery  of  sensors  primarily  because  of  the  many  combustion 
sources.  Depending  on  the  volume  of  the  particular  cargo  compartment  to  be 
monitored,  more  than  one  pair  of  smoke/heat  sensors  might  be  required.  In 
addition  to  the  heat  sensors  co-located  with  the  smoke  sensors,  line-type 
devices  could  be  mounted  on  the  ceiling  running  the  entire  length  of  the 
compartment  to  speed  detection  and  assist  localization. 

An  alternative  approach  to  be  considered  would  be  to  monitor  the  entire 
volume  of  a  cargo  or  baggage  compartment  with  spot  heat  and  smoke  sensors  in 
the  air  conditioning  supply  and  exhaust  ducts.  By  monitoring  both  the 
incoming  and  outgoing  air,  it  can  be  determined  whether  or  not  the  source  of 
the  heat  or  smoke  is  in  a  given  compartment.  A  potential  problem  with  this 
approach  is  that  time  may  be  lost  as  a  result  of  dilution  of  fire  signatures  by 
the  air  conditioning  system.  If  the  cargo  compartment  vent  ducts  are  not 
isolated,  however,  this  information  may  be  ambiguous. 

Cheek,  Attic  and  Other  Fuselage  Areas.  A  typical  transport  aircraft  will 
have  a  relatively  large  volume  of  "trapped”  space  outside  of  the  passenger 
cabin,  cargo  holds,  cockpit  and  avionics  bay.  This  volume  is  found  above  the 
cabin  ceiling  (the  "attic")  or  between  the  cabin  walls  and  the  fuselage  (the 
"sidewall")  or  between  the  cargo  compartment  walls  and  the  fuselage  (the 
"cheek").  Many  of  these  areas  are  interconnected  with  respect  to  airflow, 
although  the  movement  of  air  may  be  restricted  due  to  fuselage  ribs  or  fire 
stops . 

Because  these  hidden  areas  often  carry  electrical  and/or  hydraulic  lines 
and  are  subject  to  lint  build-up,  they  should  be  considered  for  monitoring. 
The  specific  choice  of  monitors  can  only  be  made  with  reference  to  a  particular 
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aircraft  design.  For  example,  the  Boeing  747-400  as  configured  by  most 
carriers  will  use  part  of  the  attic  as  a  crew  rest  area.  Since  this  area  will  not 
be  continuously  occupied,  it  is  a  good  candidate  for  a  smoke/heat  sensor  pair. 
Most  cheek  areas,  on  the  other  hand,  have  relatively  small  volumes.  It  may 
therefore  be  sufficient  to  monitor  them  with  continuous  filament,  line-type  heat 
sensors. 

The  presence  of  long  wire  runs  through  these  areas  presents  another 
potential  opportunity  for  monitoring.  Whenever  a  cable  harness  carries 
sufficient  electrical  energy  to  start  a  fire,  line-type  heat  sensors  could  be 
bundled  with  the  harness.  For  long  harnesses,  localizing  can  be  accomplished 
by  using  short  sections  of  sensor  wire  with  each  section  representing  a  specific 
segment  of  the  cable  run  from  front  to  rear  of  the  aircraft. 

Because  of  their  size,  it  may  not  be  practical  or  cost-effective  to  install 
monitors  in  all  attic  find  cheek  areas.  Airframe  designers  should  perform  a 
failure  modes  and  effects  analysis  and  prepare  a  critical  incident  list  to  help 
determine  which  areas  are  vulnerable  and  should  be  monitored. 

Closets  and  Storage  Bins.  Both  heat  and  smoke  sensors  of  the  spot-type 
should  be  considered  tor  coat  and  hanging  garment  bag  closets,  particularly 
those  in  which  the  garments  are  retracted  mechanically  into  a  concealed 
compartment.  Line-type  heat  sensors  might  be  considered  for  overhead 
compartments  and  can  be  installed  in  the  same  manner  as  for  the  cable 
harnesses  discussed  above.  While  closets  and  bins  do  not  appear  to  be  at  high 
risk  and  are  within  range  of  human  sensors,  they  are  at  least  partially  hidden. 
It  is  possible  for  a  fire  to  grow,  for  a  time,  undetected.  Each  storage  area 
design,  therefore,  should  be  examined  carefully  when  considering  sensor 
installation . 

OTHER  DATA  INPUTS.  An  ACES  fire  management  system  depends  primarily  on 
sensing  combustion  products  (heat  and  smoke)  to  determine  the  existence  of  a 
fire.  There  are  other  data,  however,  which  might  be  surrogate  indicators  of 
fire  or  provide  a  reference  for  more  precise  interpretation  of  the  sensor 
outputs.  This  information  is  essentially  circumstantial  evidence  of  the  existence 
of  a  fire.  The  four  most  promising  types  of  data  relate  to  flight  status,  circuit 
breakers,  electrical  loads  and  hydraulic  pressures. 

The  ACES  can  use  these  other  data  because  they  are  already  available  on  the 
digital  data  bus.  The  current  generation  of  digital  data  buses  is  defined 
according  to  ARINC  Specification  429-10  (1987).  A  further  enhancement  in  the 
concept  of  digital  information  transfer  is  underway  in  proposed  ARINC 
Specification  629.  In  essence,  a  digital  data  bus  may  be  thought  of  as  a  party 
line  on  which  specific  pieces  of  digitally-encoded  information  are  transferred 
from  one  "user"  or  subsystem  to  another.  The  information  which  the  ACES 
would  require  is  already  coded  on  the  bus.  Therefore,  the  ACES  software 
would  merely  have  to  request  "delivery”  of  the  desired  data  in  order  to  make  it 
available  to  a  decision-making  algorithm. 

Flight  status  data  such  as  vertical  speed,  outside  temperature  and  baseline 
levels  of  heat  and  aerosol  in  sensed  areas  would  be  especially  useful.  Baseline 
sensing  could  occur  automatically  when  the  last  aircraft  door  or  cargo  hatch  was 
closed.  The  position  of  these  doors  and  hatches  is  already  included  in 
monitoring  systems.  The  main  application  of  flight  status  data  would  be  to 
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provide  an  explanation  for  observed  changes  in  temperature  or  aerosol  thereby 
either  avoiding  a  false  alarm  or  supporting  the  existence  of  a  real  incident. 

Circuit  breaker  information  can  be  extremely  valuable  in  the  event  of  short 
circuits  or  major  overloads.  For  example,  if  a  positive  heat  slope  is  detected  in 
an  area  of  electrical  equipment  and  then  a  circuit  breaker  covering  the  same 
area  trips,  it  is  reasonable  to  conclude  that  a  real  fire/ smoke  incident  is 
underway.  If  the  breaker  trips  first,  alarm  criteria  can  be  revised  to  react 
more  quickly  to  increases  in  heat  or  smoke  since  there  would  be  a  greater 
likelihood  that  they  were  real. 

Electrical  load  data  can  serve  much  the  same  purpose  as  circuit  breaker 
information.  Higher  than  normal  current  flowing  in  a  particular  Diece  of 
equipment  or  through  a  certain  area  could  explain  an  increase  in  smoke  or  heat. 
Current  flows  can  also  be  used  to  determine  if  certain  equipment  which  could 
make  smoke,  such  as  galley  ovens,  are  on  or  off. 

Hydraulic  fluid  from  a  leak  can  ignite  as  a  separate  fire  or  fuel  a  fire  in 
progress.  The  leak  itself  may  be  the  result  of  a  fire  or  of  a  failure  in  the 
system.  In  either  case,  monitoring  hydraulic  pressures  which  are  already 
available  on  the  data  bus  will  provide  additional  valuable  information  to  help 
resolve  some  uncertainties. 

PROCESSOR.  The  analysis  presented  in  the  previous  Section  suggests  that  the 
best  approach  for  ACES  would  be  to  operate  on  one  of  the  32  bit  integrated 
processors  being  developed  to  run  future  avionics.  Given  the  inherent  fault 
tolerance  of  these  processors  and  their  fail-operational  and  fail-safe  design,  it 
would  not  appear  necessary  to  run  ACES  redundantly  on  a  second  computer. 

While  the  present  study  specifically  excluded  a  detailed  examination  of 
retrofitting  the  system  into  existing  aircraft,  it  should  be  noted  that  the 
processor  hardware  requirements  of  the  ACES  would  not  preclude  a  retrofit.  A 
separate  dedicated  micro-processor  could  be  added  which  would  implement  the 
ACES  logic  and  sample  the  digital  data  bus  on  those  aircraft  such  as  the  Boeing 
767  and  757  and  the  Airbus  A300-600,  A310  and  A320  which  have  them.  The 
limiting  factor  would  be  the  difficulty  of  installing  the  sensors  and  wiring  them 
back  to  the  central  processor. 

Installing  an  ACES  with  the  sophistication  suggested  by  the  configuration  in  the 
present  study  would  be  unreasonable  on  older  aircraft  equipped  with  an  analog 
data  bus.  However,  the  basic  smoke /heat  sensor  approach  and  interpretation  of 
analog  sensor  inputs  could  be  accomplished  with  an  added  micro-processor  and 
sensor  retrofits. 

The  proposed  ACES  configuration  assumes  the  existence  of  an  additional 
processor  as  part  of  system  maintainability  and  reliability.  This  is  the  built-in 
test  equipment  (BITE)  system  which  has  become  virtually  universal  in  new 
aircraft  designs.  Under  a  BITE  system,  failures  of  redundant,  non-essential 
components  are  often  kept  transparent  to  the  crew.  The  back-up  system  is 
automatically  engaged,  and  the  failure  is  logged  on  the  BITE  processor. 
Maintenance  personnel  can  then  interrogate  BITE  to  determine  corrective 
actions.  Alternatively,  the  BITE  can  take  action  and  advise  the  crew  of  the 
change  in  status. 
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The  existence  of  a  BITE  system  is  relevant  to  ACES  because  it  provides  a 
mechanism  to  identify  and  correct  sensor  failures  without  the  direct  intervention 
of  the  flight  crew.  A  failed  sensor  would  be  electronically  "placarded"  by 
ACES,  which  would  also  alter  its  logic  flow  to  operate  in  the  degraded  mode. 
Thus,  the  ACES  could  function  in  a  fail-operational  mode  and  not  affect  the 
dispatch  reliability  of  an  aircraft  design. 

CONTROLS  AND  DISPLAYS.  All  of  the  analyses  conducted  for  this  study 
suggest  that  it  would  be  possible  and,  in  fact,  desirable  to  use  existing 
warning  and  status  displays  and  input  units  for  ACES.  The  ACES  operation  as 
discussed  below  is  completely  compatible  with  the  master  warning  concept 
currently  in  use.  ACES  status  messages  are  consistent  with  other  information 
normally  placed  on  the  system  display  of  "glass  cockpit"  aircraft.  Likewise, 
ACES  warnings  can  be  presented  on  the  same  warning  display  used  by  other 
aircraft  systems. 

SOFTWARE. 

The  "intelligence"  of  the  ACES  system  will  come  from  the  decision  rules  and 
algorithms  contained  in  its  software.  The  implementation  of  the  software  should 
be  in  the  Ada  language  compiled  for  operation  on  the  contemplated  32  bit 
integrated  avionics  processors.  This  will  insure  that  the  ACES  is  compatible 
with  anticipated  industry  trends.  Ada  is  also  a  good  choice  because  code 
written  in  this  language  is  easy  to  maintain  and  transfer  from  one  operating 
environment  to  another. 

ACES  operation  will  be  governed  by  the  rules  and  logic  flow  designed  into  the 
system.  An  expert  system  such  as  ACES  can  be  programmed  to  act  in  at  least 
three  distinct  modes.  The  first  might  be  termed  "advisory  mode"  and  would 
involve  the  ACES  collecting  data,  deciding  if  a  problem  exists  and  notifying  the 
crew  of  the  problem  and  its  type.  A  second  mode  might  be  called  "recommend." 
In  this  mode,  in  addition  to  advising  the  crew  of  the  problem,  the  ACES  would 
retrieve  and  display  recommended  actions  or  checklists  and  verify  that  they 
were  performed  correctly.  In  "automatic"  mode,  ACES  would  not  only  advise 
and  recommend  but  carry  out  all  of  the  checklist  items  without  intervention  by 
the  crew. 

In  some  current  implementations  of  intelligent  systems,  the  system  operator  is 
permitted  to  select  the  mode  of  operation  .  For  example,  the  Intelligent  Air 
Attack  System  being  developed  for  the  U.S.  Navy's  F/A-18  allows  the  pilot  to 
select  a  pure  advisory  mode,  an  advisory  mode  with  special  alerting  of 
deviations  from  plan,  a  recommend  mode  with  the  system  taking  action  after 
pilot  confirmation  and  a  fully  automatic  mode  (Lind,  1987).  This  flexibility  was 
considered  necessary  by  pilots  in  a  combat  environment. 

An  ACES  operating  in  advisory  mode  would  be  optional,  since  it  would  not 
address  all  of  the  identified  problems.  In  particular,  it  would  do  nothing  to 
shorten  the  time  to  locate  and  access  the  appropriate  checklist.  A  fully 
automatic  ACES,  within  the  state-of-the-art,  could  detect  a  fire,  apply  all 
prescribed  countermeasures  and  even  assume  command  of  the  aircraft.  This 
approach,  not  unexpectedly,  proved  completely  unacceptable  to  the  pilots  and 
airline  operating  personnel  contacted  during  this  study.  It  is  also  significantly 
more  complex  and  would  require  extensive  development  time. 
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Since,  for  ACES,  an  advisory  mode  is  sub-optimal  and  an  automatic  ACES  is 
unacceptable,  the  assessed  configuration  assumed  operation  only  in  a  recommend 
mode.  Within  this  mode,  the  ACES  would  be  tasked  with  detecting  fires  and 
discriminating  them  from  false  alarms,  presenting  alerts  and  warnings  to  the 
crew,  accessing  checklists  and  assisting  in  their  accurate  completion.  The 
actual  operation  of  an  ACES  would  be  governed  by  a  set  of  decision  rules  and 
algorithms.  The  critical  design  effort  for  an  ACES  would  likely  explore  such 
rules  as: 

1.  Boolean  logic  -  The  combination  of  sensor  and  circumstantial  data  to  reach  a 
conclusion  using  deductive  reasoning. 

2.  Pattern  recognition  -  The  use  of  experimental  data  on  fires  to  quantify 
likely  problems  so  that  their  signatures  could  be  recognized. 

3.  Absolute  thresholds  -  The  determination  of  the  smoke  and  heat  threshold  or 
redline  values  as  a  function  of  relevant  flight  phase  and  mission  information. 

For  the  purpose  of  a  technology  assessment,  however,  it  is  not  possible  to 
develop  a  full  set  of  rules.  If  the  ACES  concept  is  feasible,  it  should  be  able 
to  show  merit  based  on  a  simplistic  or  ”top  level”  logic  flow.  Figure  4  shows 
the  ACES  logic  flow  used  to  assess  the  potential  benefits  of  ACES  in  the  13  fire 
scenarios  developed  during  this  study.  This  flow  makes  use  of  four  types  of 
information : 

1.  Baseline  values  -  The  ambient  conditions  at  a  defined  baseline  time  which 
for  the  purposes  of  this  analysis  was  assumed  to  occur  when  the  last  door  or 
hold  was  closed. 

2.  Smoke  level  -  The  amount  of  aerosol  measured  by  an  appropriate  sensor. 

3.  Heat  level  -  The  temperature  as  measured  by  an  appropriate  sensor. 

4.  Circumstantial  evidence  -  Data  on  flight  dynamics,  circuit  breakers, 
electrical  loads,  etc.  which  can  be  used  to  confirm  a  fire. 

The  simplified  flow  in  Figure  4  does  not  consider  fire  signature  matching 
through  curve  fitting  to  previously  identified  growth  rate  values.  It  depicts 
the  deployment  of  a  dual  smoke/ heat  sensor  battery,  although  the  logic  flow 
would  be  similar  for  only  a  single  sensor  type.  Also,  it  is  truncated  so  that 
the  flow  shown  stops  when  a  sensor  failure  or  an  alarm  condition  is  established. 
An  actual  ACES  would  continue  to  function  appropriately  in  both  events. 

The  illustrated  ACES  logic  assumes  that  the  system  has  three  states: 

1.  Normal  -  Monitoring  is  taking  place  but  no  abnormalities  are  detected. 

2.  Alert  -  Something  abnormal  has  been  detected  but  the  system  has  not 
concluded  that  an  emergency  exists.  This  state  results  in  more  stringent 
monitoring  criteria  such  as  reducing  the  thresholds  for  heat  or  smoke. 
Depending  on  the  final  design  philosophy,  alerts  could  remain  transparent  to 
the  flight  crew  or  be  reported  as  cautions  on  the  warning  display. 
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3.  Alarm  -  An  emergency  has  been  detected.  This  emergency  may  be  a  fire  or 
smoke  incident  or  another  problem  which  the  ACES  cannot  discriminate  from  a 
fire.  In  either  case,  an  emergency  response  by  the  crew  is  indicated. 

An  actual  ACES  implementation  would  define  levels  of  alert  and  alarm  and 
associated  system  responses  based  on  estimated  fire  severity.  This  added 
sophistication  would  enhance  the  system's  performance  but  was  not  considered  a 
necessary  part  of  ACES  for  a  feasibility  assessment.  In  any  alarm  or  alert 
state  of  the  ACES  system,  there  is  the  implication  that  the  system  would 
display,  in  some  way,  the  nature  of  the  alarm  or  alert  (e.g.,  smoke  only  or 
heat  only) .  The  extent  of  information  displayed  would  depend  on  the 
requirements  established  by  each  operator  for  each  aircraft  type  and  use.  In 
all  cases,  however,  the  information  must  provide  necessary  and  relevant 
support  for  crew  decisions  and  actions  in  each  detected  condition.  If  no  crew 
action  is  possible  or  desired,  workload  may  be  unnecessarily  increased  by  the 
need  to  read  and  interpret  extraneous  ACES  information. 

The  ACES  logic  as  shown  in  Figure  4  is  guided  by  three  basic  principles: 

1.  "Redline"  emergencies  -  Thresholds  or  "redlines"  will  be  established  for  all 
sensors.  If  a  measurement  is  confirmed  beyond  the  redline  value,  ACES  will 
always  produce  an  alarm,  although  the  nature  of  the  alarm  may  vary. 

2.  Variable  redlines  -  Sensor  thresholds  for  both  heat  and  smoke  will  be 
established  based  on  dispatch  conditions,  the  particular  nature  of  the  space 
being  monitored  and  the  flight's  mission.  They  are  subject  to  change  to  yield  a 
more  rapid  alarm  if  sensor  data  indicate  a  suspicious  situation. 

3.  Multiple  criteria  -  Unless  a  redline  has  been  reached,  the  ACES  will  not 
generate  an  alarm  until  warranted  by  at  least  two  criteria. 

The  start  of  the  logic  flow  involves  establishing  initial  redlines  from  baseline 
conditions  for  the  smoke  and  heat  sensors  deployed  throughout  the  aircraft. 
The  need  for  establishing  redlines  for  each  flight  arises  from  the  wide  range  of 
ambient  conditions  which  can  be  experienced  at  dispatch.  For  example,  the 
temperature  in  a  cargo  hold  after  departing  from  an  extremely  hot  desert  field 
would  be  expected  to  decrease  for  some  time  after  takeoff.  Conversely,  cargo 
hold  temperatures  after  departure  from  an  arctic  region  in  the  winter  can  be 
expected  to  rise  quite  rapidly  after  the  door  is  closed. 

Sensing  of  the  baseline  conditions  can  take  place  automatically  when  triggered 
by  an  appropriate  event  such  as  the  closing  of  the  last  door  or  hatch.  Once 
the  baseline  is  established,  the  ACES  processor,  using  appropriate  algorithms, 
would  translate  the  conditions  to  specific  smoke  and  heat  redline  values  and 
monitoring  can  begin. 

The  monitoring  logic  for  smoke  and  heat  is  identical  as  shown  in  Figure  4. 
Sampling  of  each  sensor  would  take  place  at  a  rate  consistent  with  the  activit?^ 
on  the  data  bus  and  the  priority  assigned  to  the  ACES  program  in  the  multi¬ 
function  processor.  Even  if  the  ACES  is  given  a  relatively  low  priority,  a 
sampling  rate  on  the  order  of  once  per  second  would  likely  result.  While  this 
is  relatively  slow  compared  to  the  rate  for  other  avionics  subsystems,  it  is  fast 
enough  to  accomplish  all  of  the  ACES  system  objectives. 
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The  first  decision  criterion  is  whether  or  not  the  sensor  output  exceeded  the 
redline  value.  If  this  occurs,  it  can  either  signal  a  sensor  failure,  an 
anomalous  condition  not  covered  by  the  ACES  logic  or  a  true  emergency.  Some 
sensor  failures  can  be  detected  by  the  shape  or  pattern  of  the  increase  through 
the  redline.  For  example,  if  a  sensor  produces  essentially  a  square  wave 
output  and  jumps  from  a  steady-state  to  redline  instantaneously,  a  sensor 
failure  is  virtually  certain.  Even  the  fastest  possible  fire  growth  would  not 
produce  a  sensor  output  with  infinite  slope. 

If  a  failure  is  confirmed,  the  sensor  failure  would  be  logged  on  the  BITE 
system  for  repair  at  the  earliest  opportunity.  The  sensor  would  then  be 
placarded  as  inoperative  by  the  ACES  and  removed  from  the  system.  The 
system  logic  would  be  updated  to  continue  monitoring  without  the  failed  device. 
This  entire  process  could  remain  transparent  to  the  flight  crew  if  the 
degradation  did  not  seriously  impact  flight  safety.  Alternatively,  a  status 
message  concerning  the  reconfiguration  could  be  displayed.  Actions  to  be 
taken,  if  the  loss  of  the  sensor  left  an  area  totally  unmonitored,  would  depend 
on  decisions  made  at  the  time  the  aircraft  and  ACES  system  were  certificated. 

Anomalous  conditions  might  involve  such  things  as  a  slow  increase  in  water 
vapor  from  a  pressurization  leak  or  a  runaway  heating  system.  In  an  actual 
ACES  system  for  which  a  complete  aircraft  failure  modes  and  effect  analysis  was 
available,  it  may  be  possible  to  separate  these  conditions  from  real  emergencies 
by  using  other  data  sources.  Since  in  this  feasibility  study  it  was  sufficient  to 
postulate  only  a  simple,  "basic"  ACES,  it  was  decided  to  treat  these  anomalies 
as  emergencies. 

In  the  event  that  a  redline  is  exceeded  and  sensor  failure  cannot  be  confirmed, 
an  alarm  situation  exists.  In  fact,  three  separate  alarms  might  be  involved: 

1.  A  smoke  alarm  if  only  the  smoke  sensor  exceeded  redline; 

2.  A  heat  alarm  if  only  the  heat  sensor  exceeded  redline;  and, 

3.  A  fire  alarm  if  both  exceeded  their  respective  redlines. 

Procedurally ,  it  is  assumed  that  any  one  of  these  alarm  conditions  would  require 
the  crew  to  follow  existing  checklists  and  to  divert  the  flight  to  the  "nearest 
suitable  airport."  The  urgency  of  that  diversion  and  decisions  concerning  a 
rapid  descent,  maximum  effort  stop  and  emergency  aircraft  evacuation  would 
likely  vary  depending  on  the  nature  of  the  alarm. 

If  a  redline  has  not  been  breached,  the  second  criterion  to  be  applied  would 
look  for  a  positive  slope  on  the  sensor  output.  Statistically,  quality  control 
theory  and  time  series  analyses  provide  many  ways  to  examine  trends.  The 
choice  of  a  particular  technique  to  be  used  is  beyond  the  scope  of  the  present 
effort.  Even  an  extremely  conservative  approach,  however,  such  as  waiting  for 
five  consecutive  samplings  which  were  at  least  three  standard  deviations  above 
the  previous  long-term  average,  could  detect  a  positive  slope  in  30  seconds  or 
less. 

Detection  of  a  positive  slope  would  indicate  an  alert  condition.  If  a  second 
sensor  type  (fire  or  smoke)  in  the  same  physical  area  also  was  in  alert,  an 
alarm  condition  would  result.  Moreover,  the  presumption  from  a  dual  alert  is 
that  a  fire  is  in  progress. 
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The  corroboration  of  an  alert  from  one  sensor  by  another  type  of  sensor  is  not 
the  only  means  ACES  can  use  to  to  determine  the  existence  of  an  alarm 
condition.  Three  other  means  of  verification  are  available.  These  are  shown  in 
Figure  4  and  described  below : : 

1.  Circumstantial  evidence  -  Information  on  such  things  as  circuit  breaker 
trips  and  electrical  loads  which  is  available  to  ACES  on  the  data  bus  can  be 
used  to  confirm  a  fire  alarm  condition.  Obviously,  the  specific  tests  and  data 
required  would  have  to  be  carefully  defined  and  be  specific  to  the  aircraft  type 
as  well  as  the  area  being  monitored.  If  this  evidence  exists,  ACES  can  move  a 
single  sensor  alert  to  an  alarm  without  the  need  for  a  second  sensor-based 
alert.  Circumstantial  evidence  may  be  the  primary  validation  information 
available  for  those  parts  of  the  aircraft  monitored  by  only  a  single  sensor  or  in 
the  case  of  a  sensor  failure. 

2.  Slope  duration  -  As  discussed  above,  the  determination  of  the  existence  of 
a  positive  slope  can  be  made  quite  rapidly.  It  takes  additional  time,  however, 
to  forecast  the  magnitude  of  that  slope  and  estimate  when  it  will  breach  the 
redline.  In  the  event  of  a  positive  but  relatively  small  slope,  significant  time 
may  be  wasted  waiting  for  the  sensor  value  to  reach  redline,  even  if  the  redline 
limit  is  severely  reduced.  Therefore,  once  sufficient  data  are  available  to  the 
ACES  to  forecast  with  statistical  assurance  that  the  redline  will  be  exceeded,  an 
alarm  condition  is  warranted.  The  detailed  design  of  an  ACES  would  have  to 
examine  alternative  decision  rules  related  to  sensor  slope  to  determine  exactly 
the  criteria  to  be  used. 

3.  Evidence  of  propagation  -  The  dilution  of  combustion  products  by  the  air 
conditioning  system  may  delay  an  alarm.  In  order  to  recover  some  of  the  lost 
time,  the  sequential  response  of  sensors  in  adjacent,  monitored  areas  can  be 
used.  For  example,  if  heat  begins  a  positive  slope  in  one  cheek  area  and, 
after  a  delay  of  appropriate  duration,  starts  to  rise  in  the  adjacent  cheek 
areas,  an  alarm  condition  is  suggested. 

When  an  alert  is  established  and  none  of  the  verifying  criteria  are  met,  the 
ACES  response  is  to  reset  its  redlines  to  "tighter,  more  conservative  values. 
This  will  shorten  the  response  time  to  establish  an  alarm  if  corroborating  sensor 
values  are  detected  or  if  the  output  of  the  sensor  which  triggered  the  alert 
continues  to  climb.  Redline  values  can  be  iteratively  reduced  until  an  alarm 
condition  is  achieved  or  a  pre-established  minimum  is  reached.  They  can  also 
be  reset  to  higher  levels  if  the  sensor  output  begins  to  show  a  negative  slope. 

The  ACES  logic  flow  can  be  examined  generically  with  respect  to  the  nine  cell 
matrix  for  analog  sensors  presented  earlier  (page  29).  In  that  matrix,  cells  A, 
B,  C,  D  and  G  all  involve  sensor  values  above  redline.  Therefore,  ACES 
would  generate  an  alarm  condition.  For  cell  A  in  which  both  smoke  and  heat 
redlines  have  been  exceeded,  a  definite  fire  alarm  is  indicated.  Likewise,  cells 
B  and  D,  which  are  characterized  by  a  redline  on  one  sensor  type  and  an 
increase  on  the  other,  would  warrant  a  declaration  of  a  fire. 

The  conditions  indicated  by  cells  C  and  G  involve  one  sensor  type  at  redline 
with  the  other  showing  no  change  above  steady-state.  These  would  generate  a 
specific  smoke  or  heat  alarm  condition  which  would  indicate  to  the  crew  that  a 
redline  had  been  exceeded  and  emergency  action  was  warranted  but  that  the 
data  could  not  be  definitively  resolved  as  a  fire,  sensor  failure  or  anomalous 
condition . 
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The  condition  in  cell  E  has  both  sensors  showing  a  positive  slope.  This  is  one 
of  the  defined  conditions  for  an  ACES  fire  alarm.  A  positive  slope  on  one 
sensor  and  no  response  on  the  other  is  indicated  in  cells  F  and  H.  This  is 
ambiguous  information  which  would  cause  the  ACES  to  change  to  alert  status. 
Redlines  would  be  reduced  as  the  system  monitored  for  further  indication  that  a 
fire  was  in  progress.  Cell  I  is  a  normal  condition  and  would  not  result  in  an 
ACES  system  response. 

The  ACES  configuration  just  presented  describes  a  conceptual  system  in 
sufficient  detail  to  examine  its  operation  under  the  specific  circumstances  of  the 
13  developed  fire  scenarios.  These  scenarios  and  the  application  of  the  ACES 
to  them  are  presented  in  the  next  Section. 


SCENARIO  BASED  CES  ANALYSIS 


The  13  scenarios  used  in  this  analysis  each  include  the  following  six  parts: 

1.  The  scenario  description  is  a  narrative  of  the  flight,  the  incident,  crew 
responses  and  the  outcome.  It  is  in  essentially  the  same  format  and  level  of 
detail  as  in  NTSB  and  similar  investigatory  reports. 

2.  The  fire  narrative  is  a  description  of  the  ignition  and  propagation  of  the 
fire.  The  times  of  critical  events  (e.g.,  ignition,  active  flaming  and  total 
obscuration  by  smoke)  are  estimated.  The  nature  of  the  fuels,  the  path  of 
propagation,  flame  temperature,  etc.,  are  also  identified  (if  possible)  in  this 
narrative.  Illustrations  of  fire/smoke  development  accompany  some  of  these 
narx’atives.  For  false-alarm  of  smoke-only  scenarios,  there  are  no  detailed  fire 
narratives . 

3.  The  smoke-temperature  signature  graph  depicts  the  scenario  on  an  elapsed- 
time  basis.  Fire-temperature  and  smoke-density  changes  are  plotted.  Smoke 
density  is  a  qualitative  estimate  developed  to  help  determine  the  approximate 
time  at  which  sensors  would  be  triggered. 

4.  The  problem  analysis  is  both  a  description  and  a  critique.  The  model  of 
in-flight  fires  described  earlier  (detection,  localization,  etc.)  provides  the  basis 
for  the  description.  For  each  part  of  the  model,  the  scenario  events  are 
described  briefly.  This  is  followed  by  an  evaluative  statement  about  how  well 
each  part  of  the  model  was  carried  out. 

5.  The  ACES  analysis  is  an  adaptation  of  the  problem  analysis  in  which  it  is 
assumed  that  an  appropriate,  functioning  ACES  system  was  present. 
Appropriate  crew  procedures  have  been  hypothesized  for  the  ACES  and  are 
used  in  this  analysis.  An  evaluation  is  made  of  the  benefits  that  would  result 
from  the  ACES  system. 

6.  The  timeline  summary  table  shows  each  key  event  in  the  scenario,  the  time 
at  which  it  occurred  and  the  phase  of  the  flight  in  which  it  occurred.  This  is 
arranged  in  a  timeline  at  the  bottom  of  the  table.  Above  this  are  shown 
combustion  evidence,  circumstantial  evidence,  actual  detection  and  actual 
response  related  to  each  event.  The  benefits  which  would  have  been  realized  if 
the  ACES  concept  had  been  implemented  are  shown  at  the  top  of  the  table. 
Each  ACES  benefit  is  aligned  with  the  time  at  which  it  would  have  occurred. 
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The  table  does  not  show  an  entry  in  every  category  for  each  event.  For 
example,  an  event  which  took  place  in  a  cargo  compartment  would  probably  not 
create  circumstantial  evidence,  so  no  entry  appears  in  that  category.  A  blank 
in  the  table,  then,  denotes  that  the  category  is  not  applicable  to  the  event. 
When  the  word  "same"  is  used,  it  denotes  that  the  entry  immediately  to  the  left 
has  not  changed.  The  timeline  summary  table  appears  at  the  end  of  each 
scenario. 

SCENARIO  1  -  FIRE  IN  AFT  BAGGAGE  COMPARTMENT. 

SCENARIO  1  -  DESCRIPTION.  A  wide  body  tri-jet  aircraft  with  a  Flight  Crew 
of  three  (Captain,  First  Officer  and  Flight  Engineer)  and  eleven  Attendants  in 
the  cabin  was  scheduled  for  service  between  Denver  Stapleton  International  and 
Boston's  Logan  Airport.  There  was  a  large  amount  of  bulky  baggage  (skis, 
packs,  etc.)  which  was  stowed  in  the  aft  baggage  compartment.  Baggage 
loading  and  ground  service  was  completed  with  no  unusual  events  at  1730.  The 
Flight  Crew  had  earlier  completed  a  visual  inspection  and  performed  a  pre-flight 
checklist  with  no  abnormal  indications. 

The  flight  departed  the  gate  at  1750.  Pre-takeoff  checklist  was  completed 
normally  and  the  flight  was  airborne  at  1808.  Hand  off  was  made  to  Departure 
Control  which  vectored  the  flight  out  of  the  terminal  area  on  course  and  passed 
control  to  En  Route  Control  at  1811  when  the  flight  was  eastbound  abeam  Fort 
Morgan  on  its  cleared  flight  plan.  The  weather  at  this  time  was  clear,  visibility 
at  Denver  was  2  miles,  wind  at  the  surface  was  270°  at  10-15  knots,  thin 
scattered  clouds  at  5,000  feet  in  the  flight  area  and  at  Stapleton.  At  1815 
passing  through  Flight  Level  200,  the  aft  compartment  smoke  alarm  (B  loop)  was 
activated  along  with  the  master  warning.  The  Captain  reset  the  master  warning 
and  requested  the  Flight  Engineer  (FE)  to  interrogate  the  A  loop;  the  A  loop 
tested  normal.  The  Flight  Crew  began  to  search  for  abnormal  procedures 
relative  to  the  aft  compartment  smoke  alarm.  At  1816  (Flight  Level  220)  the  A 
loop  alarm  activated.  The  Captain  reset  the  master  warning  and  directed  the 
FE  to  go  to  the  rear  of  the  passenger  compartment  to  make  a  visual  inspection 
and  to  attempt  to  detect  the  odor  of  smoke. 

At  1819  the  aft  compartment  smoke  alarm  procedures  were  located  under 
"Emergencies"  not  "Abnormal  Procedures,"  where  the  Flight  Crew  first  looked 
for  them.  These  procedures  included  a  recommendation  to  land  at  the  nearest 
available  airport.  The  FE  returned  to  the  flight  deck  at  1819:30  and  confirmed 
the  odor  of  smoke  in  the  aft  end  of  the  passenger  compartment.  The  FE  said 
that  there  was  a  fire  in  the  aft  baggage  compartment.  The  Captain  and  the 
First  Officer  then  discussed  whether  or  not  to  declare  an  emergency.  At  1820 
the  Captain  requested  and  was  granted  a  reverse  course  back  to  Denver.  At 
1824  a  Flight  Attendant  told  the  Captain  there  was  fire  in  the  passenger  cabin. 
At  1826  the  Captain  told  ATC  there  was  fire  in  the  cabin  and  was  given 
clearance  to  descend  and  was  cleared  number-one  for  a  straight-in  approach 
and  landing.  Contact  was  made  with  the  Stapleton  tower  which  confirmed  that 
fire  trucks  would  be  alerted  and  in  place  adjacent  to  the  landing  runway.  It 
was  determined  that  there  was  no  satisfactory  alternate  airport  and  during  the 
return  to  Denver,  the  passengers  were  briefed  on  emergency  procedures.  At 
1826  the  number  two  throttle  became  "stuck."  The  Pre-landing  Checklist  was 
initiated  at  1830;  the  flight  at  this  time  was  28  miles  out.  There  continued  to 
be  smoke  detector  warnings  from  the  aft  baggage  compartment.  The  passengers 
were  now  reacting  violently,  and  during  the  remainder  of  the  approach  both  the 


Flight  Crew  and  the  Cabin  Crew  attempted  to  quiet  and  control  them.  Between 
1824  and  1827  the  Cabin  Crew  collected  all  available  hand  extinguishers  and 
attempted  to  suppress  the  fire.  The  attempt  was  not  successful.  The 
passengers  were  not  briefed  on  emergency  evacuation  but  had  been  instructed 
and  were  coached  on  emergency  landing  procedures  throughout  the  approach. 
The  initial  Pre-landing  Checklist  was  completed  at  1833:  all  items  were  completed 
normally  except  that  controls  for  engine  2  were  ’'stuck.'*  Engine  2  was  shut 
down  on  final.  The  final  Pre-landing  Checklist  was  completed  at  1834.  At  1836 
the  flight  touched  down  and  the  cockpit  voice  record  ended.  The  flight  made  a 
full  roll-out  upon  landing  and  taxied  off  the  runway  and  stopped  at  1838.  fhe 
ground  communication  showed  that  the  Captain  then  shut  down  the  two  active 
engines  at  1841  and  said  that  he  was  ordering  passenger  evacuation.  The  last 
communication  from  the  flight  came  at  1842  when  the  Captain  confirmed  that  he 
was  attempting  to  evacuate  passengers. 

There  was  no  evidence  of  evacuation  from  outside  the  aircraft.  Smoke  and  la*er 
flame  engulfed  the  aircraft.  There  were  no  survivors  and  the  aircraft  was 
destroyed  by  fire. 

SCENARIO  1  -  FIRE  NARRATIVE.  A  fire  of  undetermined  origin  began  in  the 
forward  left  side  of  the  aft  cargo  compartment  (a  modified  Class  D  area)  as 
shown  in  Figure  5A.  The  fire  initially  involved  baggage  and  cargo.  The  most 
probable  time  of  ignition  was  just  prior  to  takeoff,  approximately  1800.  At 
1808,  the  first  smoke  was  generated.  As  smoke  circulated  throughout  the 
compartment  it  mixed  with  air  provided  by  the  animal  air  system  and  was 
diluted  and  partially  removed  (Figure  5B).  This  dilution  and  removal  of  smoke 
delayed  the  smoke  concentration  from  reaching  the  alarm  threshold.  At  1810 
the  gas  temperature  approximately  5  feet  from  the  burning  luggage  at  the 
ceiling  of  the  cargo  compartment  reached  approximately  150°F.  At  1814  the 
temperature  at  the  ceiling  approached  200°F  and  a  minute  later  smoke  detector 
B  went  into  alarm,  followed  a  minute  later  by  detector  A.  At  or  about  the  time 
of  the  detector  operation,  flames  were  produced  actively  from  the  burning 
luggage  and  contacted  the  cargo  liner  (Figure  5C).  At  1818  smoke  entered  the 
space  between  the  cargo  liner  and  the  hull  of  the  aircraft  and  proceeded 
upward,  entering  the  passenger  compartment.  Flames  from  the  burning  lugg-age 
were  now  in  direct  contact  with  the  aluminum  hydraulic  lines  of  hydraulic 
system  B.  At  1820  hydraulic  system  B  experienced  a  failure  and  a  high 
pressure  spray  of  hydraulic  fluid  ignited;  these  flames  impacted  the  cabin  floor 
at  the  top  of  the  cargo  compartment,  as  shown  in  Figure  5D.  Estimated 
temperature  at  the  ceiling  of  the  cargo  compartment  reached  1500°F.  At  1824 
flames  were  seen  in  the  cabin  by  a  Flight  Attendant.  The  Attendant  reported 
the  presence  of  the  fire  to  the  cockpit.  The  fire  continued  to  escalate  during 
approach,  landing  and  taxiing.  After  the  aircraft  stopped,  there  was  no 
evidence  of  an  attempt  to  evacuate  passengers.  The  interior  of  the  aircraft 
became  totally  engulfed  in  flames  and  was  subsequently  destroyed.  The 
smoke-temperature  signatures  are  shown  in  Figure  6. 

SCENARIO  1  -  PROBLEM  ANALYSIS. 

Background.  This  incident  involved  a  serious  fire  in  a  baggage 
compartment  in  the  aft  section  of  a  wide  body  tri-jet.  The  fire  resulted  in 
destruction  of  the  aircraft;  there  were  no  survivors. 

Detection  of  the  Fire.  The  first  detection  was  of  smoke  by  an  automatic 
smoke  sensor  which  produced  a  visual  and  audible  display  in  the  cockpit.  It 
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FIGURE  5C .  SMOKE  DETECTOR  ALARMS,  FIGURE  5D.  B  HYDRAULIC  LINE  FAIL- 
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FIGURE  6.  SCENARIO  1:  SMOKE-TEMPERATURE  SIGNATURES 


appears  that  this  detection  came  only  after  the  fire  had  developed  to  a  flaming 
stage.  A  second  smoke  sensor  went  off  one  minute  after  the  first.  Four 
minutes  after  the  first  sensor  had  gone  off,  the  odor  of  smoke  was  detected  in 
the  passenger  cabin.  Five  minutes  later  (nine  minutes  after  the  first  smoke 
sensor)  there  was  visible  fire  in  the  cabin.  Not  only  was  the  fire  apparently 
well  developed  before  the  first  detection  was  made,  but  response  was  further 
delayed  by  the  Captain's  unwillingness  to  accept  the  first  smoke  sensor  alarm 

without  confirmation.  Further  delay  in  responding  occurred  when  the  smoke 
warning  checklist  was  not  promptly  located. 

In  summary,  had  an  immediate  response  (declaring  an  emergency  and 
reversing  course)  been  made  to  the  first  smoke  sensor  signal,  five  minutes 
could  have  been  saved. 

Localization  of  the  Fire.  The  smoke  sensor  alarms  gave  positive  indications 
of  the  location  of  the  fire:  aft  cargo  compartment,  both  B  and  A  loops.  The 
crew  attempted  to  confirm  the  sensor  alarm  and  location  of  the  fire,  but  they 
apparently  did  not  correctly  identify  the  location  at  which  the  fire  originated. 
When  the  fire  became  visible  in  the  passenger  compartment  (nine  minutes  after 
the  first  smoke  alarm)  an  unsuccessful  attempt  was  made  to  suppress  it.  The 
crew  did  not  accept  the  initial  detection  (smoke  sensor)  and  thus  could  not  be 
said  to  have  correctly  localized  the  fire.  This  is  probably  inconsequential  since 
the  aircraft  had  no  fire  suppression  capability  in  the  area. 

Identification  of  Fire  Severity.  Once  the  fire  became  visually  apparent, 
the  crew's  identification  was  correct:  fuselage  and  other  material  in  or  near  the 
cabin  floor  and  cargo  compartment  were  burning  intensely.  It  appears  that  the 
Captain  initially  questioned  whether  the  smoke  alarm  was  valid  and  did  not 
accept  the  fact  that  the  fire  was  severe  until  it  erupted  into  the  passenger 
compartment. 

Evaluation  of  Situation  and  Choice  of  Actions.  Even  with  the  fire 
progressing  into  the  cabin  area,  the  crew  apparently  did  not  fully  appreciate 
the  risk.  Suppression  activity  was  not  initiated  until  well  after  the  fire  was 
visible  in  the  cabin.  The  Flight  Crew  continued  to  check  smoke  sensor  loops  as 
if  to  confirm  the  fire  location.  The  Captain  never  ordered  emergency 
evacuation  briefing  for  the  passengers.  From  the  record  it  would  appear  that 
the  Captain  never  made  decisive,  effective  responses  throughout  this  incident. 
Risk  assessment  has  to  be  judged  inadequate.  With  regard  to  countermeasures, 
the  critical  problem  is  that  the  use  of  extinguishers  was  neither  timely  nor 
warranted  as  the  primary  response.  Given  the  advanced  state  of  the  fire  it  is 
probable  that  no  suppressive  action  would  have  been  effective.  If,  however, 
the  initial  response  had  been  made  promptly,  there  might  have  been  more  time 
once  on  the  ground  to  evacuate  passengers.  If  the  extinguishers  had  also  been 
applied  without  delay,  the  aircraft  might  have  been  on  the  ground  with  much 
less  fully  developed  burning.  Thus,  there  might  have  been  the  opportunity  for 
emergency  evacuation . 

Conclusions.  In  this  incident  a  fire  was  detected  only  after  it  had 
apparently  developed  to  a  flaming  state.  This  situation  significantly  reduced 
the  time  available  for  making  an  effective,  safe  response.  The  problem  was 
then  exacerbated  by  the  Captain's  delaying  his  decision  to  declare  an  emergency 
and  return.  Time  was  also  lost  in  looking  for  smoke  warning  checklists  and  in 
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sending  the  Flight  Engineer  to  evaluate  the  fire  visually  before  initiating  the 
return.  Once  the  flight  had  returned,  further  delay  occurred  when  the 
Captain  made  a  routine,  full  roll-out,  landing  and  began  to  taxi  toward  a 
parking  area.  A  maximum  effort  stop  after  landing  followed  by  immediate 
emergency  evacuation  were  clearly  the  actions  appropriate  to  this  incident.  It 
is  possible  that  during  the  approach  and  landing  the  Captain  (as  well  as  all 
others  on  board)  was  less  than  fully  conscious  due  to  smoke/ fumes  inhalation. 

SCENARIO  1  -  ACES  ANALYSIS.  The  analysis  of  this  scenario  reported  in  the 
fire  narrative  shows  that  smoke  probably  appeared  in  the  aft  baggage 
compartment  at  about  1808.  The  ACES  system  would  likely  have  sensed  smoke 
soon  after  it  appeared.  It  would  have  then  almost  immediately  determined  a 
positive,  increasing  rate  of  rise.  This  would  have  established  a  smoke  alert 
and  the  system  would  have  set  a  more  stringent  redline  for  heat.  Meanwhile, 
the  ACES  heat  detector  would  have  sensed  a  heat  level  above  ambient  and 
determined  a  positive  and  slowly  increasing  rate  of  heat  rise.  The  simultaneous 
alert  for  both  heat  and  smoke  would  then  have  resulted  in  an  ACES  alarm,  i.e., 
a  true  fire  condition.  This  alarm  could  have  appeared  as  early  as  1809. 
Assuming  that  the  crew  responded  with  the  correct  emergency  procedure  and 
lost  no  time  in  further  analysis,  it  is  estimated  that  the  aircraft  could  have 
begun  descent  back  to  Denver  at  1811.  The  analysis  suggests  that  this  is  a 
conservative  estimate  of  the  time  needed  to  react  to  the  alarm,  request  and 
receive  ATC  clearance  to  return  to  Denver  and  make  a  faster  than  standard 
rate  360°  turn. 

The  ACES  benefit  then  is  that  the  aircraft  could  have  been  on  the  ground  at 
1814.  Fire  would  not  have  appeared  in  the  passenger  cabin  by  this  time  (it 

was  reported  at  1824).  The  crew  as  well  as  the  passengers  would  have  been 

exposed  to  smoke  and  fumes  a  significantly  shorter  time  than  in  the  scenario 
and  they  could  be  expected  to  respond  more  quickly  in  evacuating  the  aircraft. 
Further,  the  ACES  system  would  have  displayed  the  correct  emergency 
procedures  including  both  a  maximum  effort  stop  and  emergency  evacuation. 
That  display  might  have  helped  ensure  that  both  these  procedures  were  briefed 
and  followed  which  was  not  the  case  in  the  scenario. 

In  summary,  the  ACES  system  would  have  provided  up  to  22  minutes  in  which 

passenger  and  crew  evacuation  could  have  been  attempted.  The  actual 
touchdown  was  at  1838:  as  estimated  here,  the  ACES  system  could  have  allowed 
touchdown  at  1814.  Additionally,  the  ACES  would  have  forced  displays  of 
emergency  procedures  relieving  the  crew  of  the  stress  of  selecting  and  locating 
procedures  and  probably  increasing  the  likelihood  that  they  would  be 
performed . 
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TABLE  1.  SCENARIO  1  -  TIMELINE  SUMMARY 
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TABLE  1.  SCENARIO  1  -  TIMELINE  SUMMARY  (Continued) 
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FLIGHT  PHASE  Approach  Approach  Landing  Parked 


SCENARIO  2  -  LAVATORY  FIRE. 

SCENARIO  2  -  DESCRIPTION.  A  narrow  body  twin-jet  aircraft  was  en  route 
from  Chattanooga  to  Chicago  at  Flight  Level  310.  The  crew  consisted  of 
Captain  and  First  Officer  on  the  flight  deck  and  three  Flight  Attendants  in  the 
cabin.  There  were  45  passengers  on  board  (about  half  of  the  total  capacity). 
At  1654  three  circuit  breakers  associated  with  the  aft  lavatory's  flush  motor 
tripped.  The  Captain  attempted  to  reset  the  breakers  but  was  unsuccessful 
and  subsequently  reported  that  he  assumed  that  the  motor  had  seized  or  been 
jammed  by  foreign  matter  in  the  toilet.  Again  at  1705,  the  Captain  attempted  to 
reset  the  same  breakers  and  was  not  successful.  At  1708  when  the  flight  was 
approaching  Bowling  Green,  a  Flight  Attendant  was  alerted  to  the  odor  of  smoke 
by  a  passenger  and  discovered  smoke  and  heat  in  the  left,  aft  lavatory.  The 
lavatory  was  not  equipped  with  smoke  detectors,  but  had  Halon  extinguishers  in 
the  trash  chute  and  bin.  It  was  subsequently  determined  that  these 
extinguishers  had  activated.  The  Captain  was  notified  and  a  C02  extinguisher 
was  discharged  into  the  lavatory  at  a  seam  in  the  cabinet  from  which  smoke  was 
issuing. 

Immediately  after  attempting  to  extinguish  the  fire,  the  Flight  Attendants  moved 
the  passengers  forward  and  opened  the  air  vents  over  the  passenger  seats. 
The  Flight  Attendant  in  charge  went  to  the  flight  deck  and  told  the  Captain 
that  there  was  a  fire  in  the  aft  lavatory  and  that  the  Attendants  had  gone  to 
put  it  out.  The  Captain  directed  the  First  Officer  to  go  aft  and  investigate. 
The  First  Officer  was  unable  to  get  to  the  lavatory  because  of  the  smoke  which 
had  infiltrated  the  cabin:  the  time  was  1710.  The  First  Officer  did  not  have  a 
smoke  mask  or  portable  breathing  oxygen  with  him.  At  1710:30  he  returned  to 
the  flight  deck  and  reported  to  the  Captain  that  he  had  been  unable  to 
penetrate  the  smoke  and  suggested  an  emergency  landing.  The  Captain 
declined  to  declare  an  emergency.  The  Flight  Attendant  in-charge  and  the 
First  Officer  told  the  Captain  that  they  thought  the  smoke  was  clearing.  At 
1712,  the  First  Officer  returned  aft  with  a  smoke  mask;  he  discovered  that  the 
lavatory  door  was  hot  to  the  touch  and  decided  not  to  open  it  and  told  the 
Flight  Attendants  not  to  open  it.  While  the  First  Officer  was  aft,  the  Flight 
Attendant  again  told  the  Captain  that  the  smoke  was  clearing.  This  clearing 
apparently  occurred  when  the  lavatory  door  was  closed  after  the  discharge  of 
C02.  At  1713  the  First  Officer  returned  to  the  flight  deck,  told  the  Captain 
that  he  had  decided  not  to  open  the  lavatory  and  again  recommended  an 
emergency  landing. 

Just  after  the  First  Officer's  report,  the  master  warning  indicator  showed  that 
the  left  AC  and  DC  systems  had  both  lost  power.  At  1714,  the  Captain  called 
ATC  and  reported  an  electrical  problem  and  virtually  simultaneously,  the 
aircraft's  radar  beacon  signal  stopped  due  to  the  power  loss.  At  1715  the 
emergency  AC  and  DC  buses  lost  power  taking  out  the  attitude  and  directional 
indicators  on  both  the  left  and  right  instrument  panels.  Battery  power  was 
applied  through  the  emergency  power  switch.  Stablizer  trim  was  lost.  At  1716 
the  First  Officer  had  returned  to  his  position  on  the  flight  deck.  At  the  same 
time  the  Captain  declared  an  emergency  to  ATC  and  was  granted  clearance  for 
an  immediate  descent.  All  affected  traffic  was  notified.  ATC  informed  the 
flight  that  weather  in  the  immediate  area  was  broken  to  overcast  at  10,000  feet, 
wind  west  at  15-20  knots,  unlimited  visibility.  ATC  also  informed  the  flight 
that  Louisville  was  now  the  closest  diversion  field  at  approximately  75  miles. 
Nashville  was  also  suitable  but  was  now  approximately  90  miles  south  of 
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the  flight's  position.  Clearance  was  granted  at  1717  for  a  direct  emergency 
descent  to  Louisville.  The  Cabin  Crew  briefed  the  passengers  on  emergency 
evacuation  procedures. 

The  flight  was  unable  to  provide  all  of  the  information  requested  by  ATC  (fuel 
on  board,  passengers,  etc.)  because  of  the  difficult  emergency  operation  with 
smoke  penetrating  the  flight  deck,  no  stabilizer  trim  and  no  directional  gyros. 
ATC  encountered  some  difficulty  in  making  positive  radar  identification  because 
the  flight's  beacon  was  inoperative.  Positive  identification  was  eventually  made, 
and  ATC  provided  steering  control  (no-gyro  approach).  The  flight  crew  made 
a  successful,  but  difficult,  emergency  descent  and  approach;  they  successfully 
penetrated  the  overcast  layer  and,  at  1724,  the  flight  reported  being  VFR  at 
3,000  feet.  ATC  informed  the  flight  it  was  20  miles  from  Louisville  and  directed 
it  to  descend  to  2,000  feet  and  continue  its  straight-in  approach.  ARFF 
vehicles  were  in  place  alongside  the  landing  runway  and  the  runway/ approach 
lights  were  turned  to  full  intensity.  At  1726  the  Captain  reported  the  field  in 
sight.  The  approach  was  completed  with  ATC  assistance  and  at  1728  the  flight 
touched  down. 

The  Captain  made  a  maximum  effort  stop  and  the  emergency  engine  shutdown 
checklist  was  completed.  The  forward  cabin  doors  as  well  as  one  of  the  left 
and  both  right  side  overwing  exits  were  opened  and  both  forward  door 
evacuation  slides  deployed  and  inflated.  Eighteen  passengers  and  the  Cabin 
Crew  safely  evacuated  the  aircraft;  the  Flight  Crew  attempted  to  enter  the 
passenger  cabin  and  assist  in  evacuation  but  were  driven  back  by  smoke  and 
heat.  The  Captain  and  the  First  Officer  left  the  flight  deck  through  the 
cockpit  windows. 

It  was  later  determined  that  a  flashover  occurred  in  the  passenger  compartment 
about  one  minute  after  landing  filling  the  aircraft  with  virtually  impenetrable 
smoke  and  intense  heat.  Firefighting  and  rescue  efforts  were  severely 
hampered.  The  aircraft  was  destroyed. 

SCENARIO  2  -  FIRE  NARRATIVE.  At  approximately  1649,  the  fire  began  as  a 
result  of  arcing  uf  II.  '  A  £  genera^’*  feeder  cables  in  and  around  the  vicinity  of 
the  wiring  harness  to  the  toilet  flush  motor,  left  rear  lavatory.  At  1654  the 
flames  from  the  burning  debris  and  insulation  burned  through  the  flush  motor 
wiring  harness  resulting  in  the  simultaneous  tripping  of  the  circuit  breakers  for 
all  three  phases  of  the  motor  (Figure  7A).  Smoke  from  this  fire  was 
distributed  throughout  the  cheek  area  and  above  the  passenger  compartment  as 
shown  in  Figure  7B.  As  the  fire  grew,  it  penetrated  the  amenities  cabinet  at 
the  aft  and  the  lower  right  hand  corner,  igniting  stored  amenities  material  such 
as  bags  and  tissue.  Because  the  air  supply  was  limited  to  the  small  volume 
inside  the  amenities  cabinet,  the  fire  developed  fairly  slowly,  but  smoke  began 
to  drift  into  the  lavatory  itself.  Although  this  smoke  was  initially  drawn  off  by 
the  sanitary  ventilation  system,  the  lavatory  eventually  filled  with  a  light  haze 
of  smoke.  At  1708,  smoke  drifted  out  of  the  cracks  around  the  lavatory  door 
and  was  first  detected  by  a  passenger  who  reported  it  to  a  Flight  Attendant. 

It  is  estimated  that  the  air  temperature  in  the  lavatory  at  this  time  was 
approximately  70°-80°F  and  the  temperature  inside  the  amenities  compartment 
was  between  100°  and  200°F.  The  lavatory  door  was  opened  and  within  a 
minute  a  fire  extinguisher  was  discharged  and  the  lavatory  door  was  closed 
again.  Although  the  smoke  seemed  to  be  clearing  in  the  passenger 
compartment,  the  fire  grew  inside  the  amenities  cabinet,  which  caused  the 
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continued  build  up  of  smoke  in  the  lavatory.  At  1710,  flames  from  the  fire 
entered  the  lavatory.  At  1711  the  gas  temperatures  in  the  trash  chute  in  the 
amenities  compartment  triggered  the  Halon  system  (Figure  7C).  It  is  estimated 
that  gas  temperatures  of  approximately  250°  F  are  necessary  to  operate  the 
Halon  system.  The  temperature  rose  rapidly  in  the  lavatory,  and,  at  1712,  it 
is  estimated  that  it  reached  400-500°F  making  the  outside  of  the  door  too  hot  to 
touch.  Somewhere  between  1723  and  1728  the  fire  penetrated  the  lavatory  wall 
exposing  the  passenger  compartment  to  large  quantities  of  black  smoke  and 
heated  gases  (Figure  7D).  Temperatures  at  this  time  were  between  1,000°F  and 
1,200°F  in  the  lavatory.  At  1730,  the  aircraft  rolled  to  a  stop  and  the  doors 
were  opened.  One  minute  later  there  was  a  flashover  which  began  in  the  rear 
of  the  cabin  and  moved  forward,  engulfing  the  entire  cabin.  The 
smoke-temperature  signatures  are  shown  in  Figure  8. 

SCENARIO  2  -  PROBLEM  ANALYSIS. 

Background.  This  incident  was  caused  by  a  fire  that  began  in  the  area  of 
a  lavatory  at  the  aft  end  of  a  narrow  body  twin-jet  aircraft.  Attempts  to 
extinguish  the  fire  were  unsuccessful.  After  an  emergency  landing,  when  exits 
were  opened  for  emergency  evacuation,  a  flashover  occurred  involving  the 
entire  aircraft.  The  aircraft  was  destroyed;  the  crew  of  five  and  18 
passengers  evacuated  safely.  Twenty-seven  passengers  perished. 

Detection  of  the  Fire.  Initially,  the  fire  in  the  vicinity  of  the  lavatory 
was  detected  by  a  passenger  who  smelled  smoke.  The  fire  had  developed 
sufficiently  to  produce  discernible  smoke  and  shortly  thereafter,  had  grown 
enough  to  make  the  lavatory  door  hot  to  the  touch  and  filled  the  lavatory  with 
smoke.  Obviously  detection  occurred  only  after  the  fire  had  become  well 
developed.  Fourteen  minutes  before  the  passenger  detected  smoke,  three 
circuit  breakers  on  the  lavatory  flush  motor  "popped"  and  would  not  reset. 
While  it  could  never  be  established  definitively,  these  circuit  breakers  were 
probably  the  first  available  detection  clue.  The  Cockpit  Crew  treated  them, 
however,  as  electrical  failures  and  attempted  to  reset  immediately  and  again 
after  a  period  of  cooling.  Neither  attempt  was  successful.  The  Captain  did  not 
order  a  visual  inspection  of  the  lavatory  area  adjacent  to  the  flush  motor. 

Localization  of  the  Fire.  Smoke  was  seen  in  the  aft  lavatory  and  it  was 
correctly  assumed  that  the  fire  was  in  or  communicating  with  the  lavatory.  In 
attacking  the  fire,  the  Flight  Attendant  "saturated  the  lavatory"  even  though 
the  prescribed  procedure  is  to  apply  the  extinguishing  agent  directly  at  the 
base  of  the  fire.  In  this  scenario,  locating  the  fire  would  have  required 
breaking  through  the  lavatory  wall.  Such  aggressive  fire  attack,  however,  is 
not  specified  for  flight  crews. 

Identification  of  Fire  Severity.  Since  the  fire  source  was  never  located, 
there  was  no  visual  estimate  of  severity.  The  intensity  of  the  smoke  and  the 
heat  of  the  lavatory  door  led  to  the  conclusion  that  it  was  a  significant  fire. 
However,  an  apparent  reduction  in  smoke  level  reported  by  a  Flight  Attendant 
to  the  Captain  was  wrongly  interpreted  to  mean  that  the  severity  was  reduced. 
It  is  very  probable  that  this  apparent  reduction  in  smoke  was  simply  the  result 
of  closing  the  lavatory  door  (after  use  of  an  extinguisher)  which  allowed  the 
cabin  air  system  to  dilute  the  smoke  in  that  area. 
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FIGURE  8.  SCENARIO  2:  SMOKE-TEMPERATURE  SIGNATURE 


Evaluation  of  Situation  and  Choice  of  Action.  The  initial  evaluation  and 
response  using  a  CO„  extinguisher  was  appropriate  but  it  was  not  properly 
implemented:  the  source  was  never  seen  and  thus  the  agent  could  not  have 
been  applied  to  the  base  of  the  flame  as  required  for  this  agent  to  be  effective. 
The  Captain  accepted  and  relied  on  the  observations  and  reports  of  the 
Attendants.  He  did  not  interrogate  them  for  more  detailed  information  nor  did 
he  direct  them  to  take  specific  steps  to  obtain  a  more  definitive  picture  of 
severity.  The  Captain  deferred  declaring  an  emergency  while  he  was  receiving 
the  reports,  and  during  this  interval  the  fire  further  increased  in  intensity. 

Conclusions.  The  Captain  did  not  have  a  valid  assessment  of  the  fire's 
severity .  Further,  he  did  not  declare  an  emergency  and  divert  to  an  alternate 
field  when  he  was  first  made  aware  of  the  fire.  Had  an  immediate  diversion 
been  made,  the  flight  could  have  landed  between  three  and  seven  minutes 
earlier.  That  interval  might  have  allowed  complete  evacuation. 

SCENARIO  2  -  ACES  ANALYSIS.  The  analysis  reported  in  the  fire  narrative 
for  this  scenario  indicates  that  the  fire  ignited  at  about  1649  under  the  floor  of 
the  aft  lavatory.  Insulation  on  the  wiring  of  the  flush  motor  was  burned 
through  leading  to  the  nearly  simultaneous  tripping  of  three  circuit  breakers 
(one  on  each  phase  of  the  motor)  at  1654.  It  is  estimated  that  smoke  appeared 
in  the  lavatory  possibly  as  early  as  1652. 

Considering  first  an  ACES  instrumentation  of  only  the  lavatory,  it  is  probable 
that  smoke  would  have  been  sensed  at  no  later  than  1655  (depending  on  the 
location  of  the  sensor  and  the  rate  of  smoke  movement).  The  ACES  would  have 
almost  immediately  determined  a  positive,  slow  rate  of  rise  in  smoke  intensity. 
This  would  place  the  system  in  a  smoke  alert  and  reset  the  heat  detector 
redline.  At  about  the  same  time,  however,  the  circuit  breakers  had  "popped" 
and  ACES  would  interpret  this  as  circumstantial  evidence  and  would  have  gone 
into  a  positive  alarm  state  denoting  the  almost  certain  existence  of  a  fire. 
Because  the  origin  of  the  fire  was  remote  from  the  lavatory  and  because  the 
burning  that  did  occur  in  the  trash  chutes  was  automatically  extinguished,  the 
lavatory  temperature  signature  did  not  begin  to  change  until  about  1703. 
Recognition  of  the  breaker  trips  would  have  allowed  ACES  to  localize  the  fire  to 
the  flush  motor  area  and  not  the  lavatory  itself.  This  would  have  indicated  to 
the  Flight  Crew  that  suppression  efforts  would  likely  be  ineffective  and  directed 
their  attention  to  an  immediate  diversion.  Given  initial  ACES  smoke  sensing  at 
1655,  it  can  be  assumed  that  the  positive  alarm  would  have  occurred  at  no  later 
than  1656.  Allowing  one  minute  for  crew  reaction  and  decision  making,  i.e., 
decide  to  land  at  nearest  suitable  field,  and  a  further  two  minutes  for  request 
and  receipt  of  an  ATC  clearance,  this  flight  could  have  been  in  descent  toward 
an  alternate  at  1659 — a  full  18  minutes  earlier  than  actually  occurred.  Further, 
if  the  diversion  had  begun  at  1659,  Nashville  would  have  been  the  closest 
appropriate  field  and  at  that  time  was  about  5  minutes  flying  time  from  the 
flight's  position.  Thus,  the  flight  could  have  been  on  the  ground  at  1704  in 
contrast  to  the  actual  time  of  1724.  At  1704  the  smoke  had  not  penetrated  into 
the  passenger  compartment,  and  it  is  likely  that  a  maximum  effort  stop  and  a 
safe  emergency  evacuation  could  have  been  made  of  all  passengers  and  crew. 

While  it  is  believed  that  the  reaction  and  response  tines  used  above  are 
conservative,  the  fire  narrative  suggests  that  even  if  the  time  of  touchdown 
were  as  late  as  1710  a  safe  evacuation  would  have  been  possible.  Beyond  1710, 


the  fire  is  fully  active  and  growing  which  greatly  reduces  the  opportunity  for 
complete,  safe  evacuation.  Thus,  in  this  situation  the  ACES  system  gives  the 
crew  significantly  greater  time  to  plan  and  execute  the  diversion.  As  a 
consequence  of  this  specific  flight  path,  not  only  is  there  more  time  available, 
but  also  the  flight  would  have  been  closer  to  an  appropriate  diversion  field  than 
was  the  case  in  the  actual  scenario. 

A  different  perspective  of  the  ACES  system  is  afforded  by  this  scenario.  This 
fire  occurred  in  an  under-floor  space  which  might  be  a  candidate  for 
instrumentation.  In  the  ACES  concept,  the  selection  and  location  of  sensors 
and  detectors  will  be  guided  by  the  relative  risk  of  fire  in  the  various  aircraft 
areas  as  well  as  by  the  potential  consequence  of  fire  in  these  areas.  Had  the 
area  under  the  aft  lavatory  been  selected,  because  of  the  presence  of  electrical 
systems  and  hydraulic  lines  as  well  as  proximity  to  a  passenger  area,  the  ACES 
system  would  have  sensed  smoke  and  heat  and  determined  positive  rise  rates  for 
both  even  earlier  than  would  the  ACES  instrumentation  in  the  lavatory  only. 
The  result  would  have  been  an  earlier  alarm  even  without  the  information  from 
the  tripped  circuit  breakers.  This  is  not  to  suggest  that  this  particular 
under-floor  area  should  be  included  in  any  given  ACES  implementation.  It  is 
simply  illustrative  of  the  types  of  considerations  needed  to  reach  final  design 
decisions . 
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TABLE  2.  SCENARIO  2  -  TIMELINE  SUMMARY  (Continued) 


KLICirr  I’HASE  Descent  l-inding 


SCENARIO  3  -  RESPONSE  TO  FALSE  ALARM. 

SCENARIO  3  -  DESCRIPTION.  A  wide  body,  four-engine  jet  aircraft  with  a 
flight  crew  consisting  of  Captain  and  First  Officer  and  a  cabin  crew  of  10 
Attendants  was  dispatched  from  San  Francisco  to  Tokyo  via  Anchorage.  The 
pre-flight  checks  were  all  completed  normally.  Because  of  an  unusually  large 
amount  of  bulky,  oversize  luggage  and  packages,  the  aft,  bulk  baggage 
compartment  was  a:  least  half  full.  The  flight  departed  San  Francisco  at  1200 
and  made  a  normal  takeoff,  departure  and  climb.  The  crew — Flight  and 
Cabin — was  experienced,  fully  qualified  for  the  aircraft  and  had  flown  together 
frequently . 

At  1330  a  brief  intermittent  indication  of  smoke  in  the  lower  aft  baggage 
compartment  appeared  on  the  fire  warning  panel  and  the  master  warning 
indicator  was  activated.  The  Captain  reset  the  master  warning:  the  smoke 
indication  was  momentary  and  upon  being  reset  remained  normal.  The  Captain 
and  First  Officer  discussed  the  implications  of  the  apparently  transient 
indication  of  smoke.  They  directed  the  Senior  Flight  Attendant  to  examine  the 
passenger  compartment,  especially  the  aft  section,  for  any  odor  or  visible  signs 
of  smoke.  While  this  was  being  done,  the  Flight  Deck  crew  checked  the 
electrical  and  warning  systems  and  found  all  indications  normal. 

The  Captain  concluded  that  the  transient  indication  was  a  false  alarm,  the 
result  of  equipment  malfunction  or  the  presence  of  vapor  or  dust  which 
generated  a  "smoke"  indication.  He  informed  the  Senior  Flight  Attendant  of  the 
situation  and  directed  that  all  Attendants  be  made  aware  of  the  occurrence  of 
the  false  smoke  alarm  and  remain  alert  for  smoke  odor  and  visible  smoke. 

At  1345  the  same  compartment  smoke  indicator  again  showed  a  brief,  intermittei  t 
signal  and  the  master  warning  indicator  was  activated.  The  smoke  indicator 
then  turned  steady  indicating  smoke  in  the  compartment.  The  Captain  reset  the 
master  warning  indicator,  directed  the  First  Officer  to  activate  the  first  fire 
bottle  and  then  declared  an  emergency  to  ATC  and  requested  immediate  descent 
and  direct  clearance  to  Seattle-Tacoma  International.  At  this  time,  the  flight 
was  875  miles  en  route  from  San  Francisco,  1200  miles  from  Anchorage  and  475 
miles  WNW  of  Seattle-Tacoma,  which  was  the  closest  suitable  airport  with 
acceptable  weather.  Diversion  to  Seattle-Tacoma  was  estimated  to  take  50 
minutes . 

Following  company  procedures,  the  Captain  set  the  cabin  altitude  to  10,000  feet, 
set  pack  1  to  maximum  on  and  placed  the  equipment  cooling  valve  control  switch 
at  SMOKE.  He  donned  his  oxygen  mask  and  selected  100%.  He  summoned  the 
Senior  Flight  Attendant  for  a  briefing  on  preparations  for  emergency  landing. 
The  First  Officer  also  donned  his  oxygen  mask  at  100%.  ATC  cleared  the  flight 
direct  to  Seattle  and  gave  approval  for  an  immediate  emergency  descent.  A 
weather  briefing  was  issued,  all  controlled  traffic  was  notified  of  the  emergency 
and  diverted  as  required.  Emergency  services  were  alerted  at  Seattle-Tacoma 
and  aircraft  rescue  and  fire  fighting  (ARFF)  equipment  was  dispatched  to  the 
landing  runway  and  adjacent  taxiways. 

At  1420  the  flight  entered  Seattle-Tacoma  Approach  Control  and  final  clearance 
was  given  for  a  straight-in  approach.  The  Captain  planned  to  execute  a 
maximum  effort  stop  after  landing.  Over  the  intercom,  the  Captain  directed  the 
Flight  Attendants  to  review  with  the  passengers  the  procedure  for  evacuation  at 
the  conclusion  of  the  landing  roll.  The  Seattle-Tacoma  tower  saw  evidence  of 
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smoke  as  the  aircraft  was  on  final,  and  the  Captain  confirmed  a  maximum  effort 
stop  and  emergency  passenger  evacuation.  Touchdown  was  at  1438  and  the 
aircraft  stopped  in  two-thirds  of  the  runway.  All  emergency  evacuation  slides 
were  successfully  deployed.  Passengers  and  crew  safely  exited  the  aircraft 
with  only  minor  injuries;  the  passengers  were  directed  away  from  the  aircraft 
by  emergency  personnel  and  the  fire  crew  opened  all  baggage  compartments  and 
entered  the  passenger  compartment.  No  evidence  of  smoke  or  fire  was 
discovered.  An  inspection  panel  in  the  area  of  the  baggage  compartment  was 
only  partially  fastened. 

Subsequent  investigation  indicated  that  the  smoke  detector  had  malfunctioned 
because  of  a  connector  failure  which  allowed  a  short  to  ground  to  occur.  The 
"smoke"  evidence  seen  by  the  tower  was,  in  fact,  dust  and  water  vapor  which 
apparently  issued  from  the  partially  opened  inspection  panel. 

SCENARIO  3  -  FIRE  NARRATIVE.  This  incident  resulted  in  a  false  alarm  and 
no  actual  fire.  Therefore,  a  fire  narrative  is  not  included. 

SCENARIO  3  -  PROBLEM  ANALYSIS. 

Background.  The  flight  in  which  this  incident  occurred  had  been  airborne 
for  one  and  one-half  hours  and  was  approximately  three  hours  from  its  next 
intermediate  stop.  An  intermittent  smoke  alarm  was  judged  to  be  false  but  a 
subsequent  steady-state  alarm  was  accepted  as  a  true  indication  and  emergency 
landing  procedures  were  initiated.  All  appropriate  emergency  procedures 
including  use  of  an  extinguishing  system  and  passenger  evacuation  were 
followed.  Ultimately,  the  alarm  proved  to  be  false. 

Detection  of  the  Fire.  In  this  incident,  detection  was  made  through  a 
smoke  sensor  located  in  the  aft  baggage  compartment.  An  initial  intermittent 
indication  was  interpreted  as  a  false  alarm  but  later  when  the  alarm  went  to  a 
steady  state  it  was  considered  a  true  alarm.  Detection  was  accomplished 
quickly  and  correctly,  i.e.,  the  alarm  was  accepted  as  evidence  of  smoke  in  the 
compartment.  No  smoke  odor  or  visible  smoke  was  detected.  No  second  sensor 
converted  by  "AND"  logic  was  available  for  verification. 

Localization  of  the  Fire.  Localization  was  not  an  issue  in  this  incident 
because  the  alarm  itself  indicated  the  location:  the  aft  baggage  compartment. 

Identification  of  Fire  Severity.  The  Captain  in  this  incident  is  not 
required  to  assess  severity  because  his  only  response  option  is  to  activate  the 
extinguisher  system,  declare  an  emergency  and  proceed  to  the  nearest  alternate 
airfield:  all  of  which  were  done.  Had  the  Captain  (for  whatever  reason)  judged 
the  severity  to  be  tolerable  for  continuation  of  the  flight,  he  might  have  simply 
continued  to  the  intermediate  stop.  He  might  have,  for  example,  assumed  that 
the  Class  D  status  of  the  compartment  ensured  containment  of  the  fire  and  the 
integrity  of  the  aircraft.  Such  a  decision,  however,  would  be  in  direct 
violation  of  the  specified  procedures  and  would  not  be  logical  in  this  situation 
where  there  was  a  relatively  long  flight  to  the  intermediate  stop. 

Evaluation  of  Situation  and  Choice  of  Action.  This  process  was  a  routine 
response  in  this  situation.  The  immediate  diversion  and  activation  of  the 
extinguishing  system  was  the  only  possible  response  and,  further,  it  was 
mandateo  by  the  company's  emergency  procedures.  Also,  the  declaration  of  an 
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emergency,  and  the  decision  to  make  a  maximum  effort  stop  and  evacuate  the 
passengers  were  fully  warranted  by  the  evidence  of  the  smoke  alarm 
substantiated  by  the  tower's  incorrect  determination  that  smoke  was  issuing 
from  the  aircraft  during  landing. 

Conclusion .  This  incident  was  handled  in  exact  conformance  with  specified 
procedures.  Had  the  first  indication  of  alarm  been  accepted  as  true,  the 
Captain  would  have  declared  an  emergency  about  15  minutes  earlier  than  he 
did.  If  there  had  been  a  fire,  this  interval  might  have  been  significant  for 
extinguishment.  In  this  incident,  that  delay  was  not  important.  The  maximum 
effort  stop  and  slide  evacuation  might  not  have  been  employed  if  the  dust  and 
water  vapor  had  been  correctly  identified  and  not  presumed  to  be  smoke. 

SCENARIO  3  -  ACES  ANALYSIS.  This  scenario  depicts  a  false  alarm  to  which 
the  crew  made  a  complete  emergency  response.  The  ACES  system  would  have 
determined  the  first,  intermittent,  signals  from  the  sensor  to  be  false  because 
the  signal  would  have  stepped  instantaneously  from  zero,  i.e.,  no  smoke,  to 
redline  level.  Any  real  fire  or  smoke  incident  would  have  built  up  to  the 
redline  in  a  ramp  function.  The  ramp  may  have  been  steep,  but  the  change 
would  not  have  been  instantaneous  in  the  shape  of  a  square  wave. 

At  the  same  time  that  the  ACES  system  would  have  informed  the  cockpit  that 
there  was  a  system  malfunction,  it  would  have  reset  the  redline  limits  on  the 
associated  heat  detector.  It  would  also  have  reset  the  limits  on  both  heat  and 
smoke  detectors  in  adjacent  areas.  The  failed  sensor  would  have  been 
"placarded"  by  ACES  and  removed  from  the  system. 

Meanwhile  in  addition  to  identifying  the  step  function,  the  ACES  system  would 
have  evaluated  the  heat  detector  paired  with  the  malfunctioning  smoke  detector 
as  well  as  the  relevant  circumstantial  indications.  Again  the  conclusion  would 
have  been  that  the  alarm  was  false. 

The  benefit  of  ACES  in  this  situation  is  that  the  flight  could  have  continued 
normally.  Even  if  the  Crew  elected  (or  was  compelled  by  policy  or  regulation) 
to  divert  because  of  a  malfunction  in  the  ACES,  the  assurance  that  the  alarm 
was  false  would  allow  them  to  be  more  selective  as  to  a  diversion  field.  Normal 
flight  landing  and  deplaning  procedures  would  also  be  followed  thereby  avoiding 
the  minor  injuries  associated  with  the  emergency  evacuation. 
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TABLE  3.  SCENARIO  3  -  TIMELINE  SUMMARY 
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FLIGHT  PHASE  Cruise  Cruise  Cruise  Approach  Landing 


SCENARIO  4  -  FALSE  ALARM. 

SCENARIO  4  -  DESCRIPTION.  A  narrow  body  tri-jet  aircraft  was  at  Flight 
Level  240  en  route  from  Little  Rock,  Arkansas  to  St.  Louis,  Missouri.  Takeoff 
and  climb  to  en  route  altitude  were  normal.  There  were  60  passengers  on  board 
(the  aircraft  was  configured  for  142  passengers  -  single  class).  At  1340,  30 
minutes  after  takeoff,  the  flight  was  150  miles  north  of  Little  Rock  and  about 
200  miles  from  Lambert  St.  Louis  International  Airport,  its  destination;  it  was 
about  60  miles  west  of  Poplar  Bluff  (Earl  Fields  Memorial  Airport).  At  this 
time,  the  smoke  detector  indicator  for  the  aft  lavatory  activated  along  with  the 
master  warning  indicator.  The  Captain  reset  the  master  warning  and  directed  a 
Flight  Attendant  to  investigate.  He  also  dispatched  the  First  Officer  to  the 
scene  in  accordance  with  company  procedures.  The  First  Officer  took  his 
smoke  mask  and  oxygen  bottle  and  was  advised  by  the  Captain  to  make  a 
prompt  assessment  and  report  back  to  the  flight  deck  on  the  intensity  and 
quantity  of  smoke,  the  source — if  identifiable — and  the  potential  for  controlling 
the  source.  This  procedure  is  specified  in  the  company  manual.  A  hand-held 
Halon  extinguisher  is  mounted  on  the  bulkhead  behind  the  last  passenger  seat 
on  the  right  side.  The  First  Officer  would  use  this  extinguisher  to  attack  the 
fire.  At  1343  the  First  Officer  was  at  the  scene. 

Upon  arrival  at  the  lavatory,  neither  the  Flight  Attendant  nor  the  First  Officer 
was  able  to  detect  any  smoke.  There  was  no  odor  of  burning.  The  First 
Officer  reported  this  condition  to  the  Captain  who  directed  that  a  further 
search  be  made.  A  thorough  examination  of  the  entire  lavatory  was  then  made 
and  no  signs  of  smoke,  fire  or  excessive  heat  were  found.  At  1348,  the  First 
Officer  and  the  Flight  Attendant  completed  their  search  and  concluded  that  the 
detector  signal  was  a  false  alarm.  The  First  Officer  reported  to  the  Captain 
that  the  search  was  ended.  The  Captain  directed  the  Flight  Attendant  to 
placard  the  lavatory  out  of  operation  and  to  continue  to  monitor  for  any 
indications  of  smoke  or  fire  throughout  the  remainder  of  the  flight.  The  First 
Officer  returned  to  the  Flight  Deck  at  1351.  The  Captain  reported  the  incident 
on  company  radio  and  requested  maintenance  to  be  available  upon  arrival.  The 
flight  continued  without  further  incident  and  landed  at  St.  Louis  at  1425. 

It  was  subsequently  determined  by  maintenance  that  the  smoke  detector  had 
malfunctioned,  and  it  was  replaced. 

SCENARIO  4  -  FIRE  NARRATIVE.  This  incident  was  .the  result  of  a  smoke 
sensor  malfunction  and  no  actual  fire.  Therefore,  a  fire  narrative  is  not 
included. 

SCENARIO  *  -  PROBLEM  ANALYSIS. 

Background.  This  false-alarm  incident  took  place  30  minutes  after  takeoff 
on  a  short  flight  when  the  aircraft  was  over  an  area  in  which  many  alternate 
airfields  were  readily  accessible. 

Detection  of  the  Fire.  Detection  occurred  when  a  smoke  alarm  was 
activated  in  the  cockpit.  Detection  was  immediate  and  the  alarm  was  accepted 
as  evidence  of  a  fire. 

Localization  of  the  Fire.  Localization  was  simultaneous  with  the  alarm 
because  the  sensor  is  located  in  the  aft  lavatory.  More  exact  localization  was 
not  required  since  the  alarm  proved  false. 
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Identification  of  Fire  Severity.  By  means  of  direct  examination  of  the  aft 
lavatory  (by  both  an  Attendant  and  the  First  Officer)  it  was  determined  that 
there  was  no  fire.  This  was  done  correctly  and  quickly. 

Evaluation  of  Situation  and  Selection  of  Action.  The  Captain  selected  an 
appropriate  response  action  by  directing  the  First  Officer  to  assess  the 
situation  and  prepare  to  use  a  hand-held  extinguisher.  This  was  done 
immediately  upon  the  receipt  of  the  smoke  alarm  and  thus  was  timely.  Upon 
discovery  that  there  was  not  a  fire,  the  Captain  ordered  that  close  surveillance 
be  maintained  in  the  vicinity  of  the  lavatory.  He  requested  the  company  to 
have  maintenance  available  at  the  destination  and  continued  the  flight.  All  of 
the  response  actions  were  appropriate  and  properly  executed. 

Conclusions .  Even  though  the  alarm  proved  false,  the  Captain  properly 
initiated  a  response  that  could  have  extinguished  or  at  least  contained  a  fire  in 
the  lavatory.  He  thus  took  the  steps  needed  to  keep  the  fire  (had  it  existed) 
from  invading  the  passenger  compartment  or  at  least  slowing  its  invasion. 
Subsequent  actions  could  have  proceeded — if  needed — while  the  fire  was  being 
fought.  Overall,  the  scenario  depicts  prompt,  correct  emergency  responses. 

SCENARIO  4  -  ACES  ANALYSIS.  In  this  scenario  a  lavatory  smoke  detector 
signals  an  alarm;  the  crew  examines  the  area  and  determines  it  to  be  free  of 
any  fire  or  smoke  condition.  An  ACES  system  would  have  determined  that  the 
smoke  detector  had  malfunctioned  by  determining  that  the  signal  was  a  discrete 
step  function  and  not  a  ramp  as  would  be  the  case  in  a  real  fire/smoke  event. 
The  ACES  would  have  also  determined  no  heat  above  ambient  and  no 
circumstantial  evidence.  For  this  scenario  the  ACES  benefit  is  primarily  that  of 
confidence  in  the  conclusion.  There  would  have  been  only  minimal  time  savings 
from  an  ACES  system  determination.  This  scenario  did  involve  a  two-person 
flight  crew  and  the  First  Officer  was  directed  to  leave  the  cockpit  to  examine 
the  lavatory  area.  It  is  easy  to  think  of  situations  in  which  both  pilots  should 
stay  in  the  cockpit.  The  ACES  would  have  allowed  that. 
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TABLE  4.  SCENARIO  4  -  TIMELINE  SUMMARY 
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FLICItT  PHASE  Cruise  Cruise  Cruise 


SCENARIO  5  -  LAVATORY  FIRE  -  EXTINGUISHED. 


SCENARIO  5  -  DESCRIPTION.  A  wide  body  tri-jet  aircraft  with  a  flight  crew 
consisting  of  Captain  and  First  Officer  and  a  cabin  crew  of  12  Attendants,  was 
dispatched  non-stop  from  San  Francisco  to  JFK.  Takeoff  was  at  2200  Pacific 
time;  estimated  time  en  route  5  hours,  15  minutes.  The  Flight  Deck  Crew  and 
Flight  Attendants  were  all  fully  certified  and  type-qualified.  Pre-Flight 
Checklist  and  Before-Takeoff  Checklist  were  completed.  There  were  250 
passengers  on  board.  Takeoff  and  departure  were  normal  and  climb  to  Flight 
Level  330  was  initiated  en  route  to  Salt  Lake  (first  waypoint).  Cheyenne  was 
the  second  point.  At  2400  (Pacific  Time)  the  flight  cleared  Cheyenne  en  route 
to  Omaha. 

At  0015  a  Flight  Attendant  in  the  aft  cabin  detected  a  smoky  odor  and,  upon 
inspection  of  the  lavatories,  discovered  smoke  issuing  from  the  amenities 
counter  of  the  center  lavatory.  The  Flight  Attendant  immediately  notified  the 
Captain.  The  smoke  indicator  and  master  warning  indicator  had  activated  at 
the  time  of  the  Flight  Attendant's  call.  The  Captain  directed  the  First  Officer 
to  go  aft  (taking  smoke  mask  and  oxygen  bottle)  to  direct  the  attack  on  the 
fire;  he  ordered  the  Flight  Attendant  to  use  a  hand-held  extinguisher.  The 
Captain  then  donned  his  oxygen  mask,  selected  100%  and  proceeded  through  the 
cabin  smoke/fire  procedures:  pack  flow  control  latched  in;  altitude  set  selector, 
10,000  feet;  normal  rate  selector,  full  increase;  and  forward  outflow  valve 
moved  manually  toward  closed.  The  First  Officer  reported  to  the  Captain  from 
the  back  of  the  aircraft  that  extinguishers  were  being  used  and  that  the  fire 
appeared  to  be  controllable.  The  Captain  declared  an  emergency  to  ATC  and 
reported  on  company  radio.  At  0021  he  requested  weather  and  facilities 
information  on  Omaha  and  Kansas  City  as  diversion  fields. 

The  First  Officer  returned  to  the  flight  deck  at  this  time  and  reported  that  the 
fire  had  been  contained  and  was  now  being  completely  extinguished  by  the 
Attendants.  The  Captain  advised  the  passengers  of  the  emergency  and 
reassured  them  that  the  fire  had  been  extinguished  but  that  the  flight  would  be 
diverted . 

The  weather  in  the  area  was  being  generated  by  a  cold  front:  the  flight  was 
above  a  solid  layer  of  stratus  at  about  10,000  feet  with  broken  stratocumulus 
below  that.  A  line  of  towering  cumulus  extended  along  the  north-south  frontal 
face.  This  line  was  east  of  the  flight's  location  about  180  miles  and  was 
roughly  perpendicular  to  the  flight  path.  It  was  estimated  that  the  front  would 
be  in  the  Omaha  area  at  approximately  0400  and  the  associated  thunderstorms 
would  be  of  severe  intensity,  visibility  would  be  restricted  to  less  than  1/4  mile 
in  rain.  Kansas  City  reported  a  similar  forecast. 

The  flight  was  estimating  one  hour  to  Omaha  or  one  and  one-quarter  hours  to 
Kansas  City  plus  additional  time  as  needed  to  vector  through  the  front. 

At  0032  a  Flight  Attendant  reported  that  a  second  extinguisher  had  been 
expended  and  that  there  were  no  visible  signs  or  odor  of  active  burning.  No 
visible  smoke  was  present  and  only  the  odor  of  the  extinguished  residue 
remained.  The  Captain  directed  that  only  the  two  outboard  lavatories  were  to 
be  used  and  that  one  Flight  Attendant  was  to  remain  in  the  area  to  enforce  that 
and  to  prevent  passengers  from  gathering  in  the  aft  compartment.  The  Captain 
informed  the  passengers  of  these  conditions. 
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At  0035  the  Captain  elected  Kansas  City  for  diversion.  Clearance  was  granted 
for  a  direct,  straight -in  approach,  all  controlled  aircraft  were  informed  of  the 
emergency  and  were  diverted  as  required.  Emergency  facilities  at  Kansas  City 
were  notified  and  deployed  to  the  taxiways  adjacent  to  the  landing  runway  in 
accordance  with  the  field's  emergency  procedure. 

At  0050,  after  confirming  that  there  were  no  further  signs  of  active  fire  or 
smoke,  the  Captain  declined  to  make  a  maximum  effort  stop  landing. 

At  0115  the  Before-Landing  Checklist  was  completed  normally.  Normal  approach 
and  landing  were  accomplished.  Emergency  equipment  and  crews  followed  the 
aircraft  to  the  gate  where  passengers  and  crew  exited  the  aircraft  via  the 
normal  exit  ways. 

Subsequent  investigation  suggested  that  a  lighted  cigarette  had  been  dropped, 
or  rolled  from  the  built-in  ash  tray,  into  paper  products  stored  in  the  amenities 
counter. 

SCENARIO  5  -  FIRE  NARRATIVE.  This  fire  incident  was  probably  the  result  of 
a  passenger  leaving  a  lighted  cigarette  in  the  ash  tray  on  the  amenities  counter 
in  the  lavatory.  Smoke  was  produced  as  a  result  of  paper  material  in  contact 
with  the  smoldering  cigarette  after  it  rolled  into  a  storage  bin.  This  incident 
did  not  escalate  to  the  flaming  stage  since  it  was  quickly  extinguished.  No 
diagram  is  presented  because  detection  was  rapid  and  accomplished  both 
manually  and  automatically. 

SCENARIO  5  -  PROBLEM  ANALYSIS. 


Background.  This  incident  occurred  about  mid-way  in  an  eastbound 
transcontinental  flight.  A  Flight  Attendant  and  the  lavatory  smoke  detector 
detected  smoke  at  the  same  time.  The  fire  had  not  developed  into  a  large  one 
and  was  extinguished  by  the  crew.  The  flight  diverted  safely  to  an  alternate 
air  field. 

Detection  of  the  Fire.  The  presence  of  smoke  was  detected  at  the  same 
time  by  a  Flight  Attendant  and  by  the  lavatory  smoke  detection  system.  The 
detection  was  positive  and  was  made  quickly. 

Localization  of  the  Fire.  Since  the  detection  was  by  an  automatic  system, 
the  location  was  established  within  the  lavatory.  The  Attendant's  visual 
inspection  located  it  more  precisely  as  being  in  the  amenities  counter. 

Identification  of  Fire  Severity.  There  was  no  explicit  analysis  made  of  the 
severity.  The  crew  attacked  the  fire  successfully  and  without  injury  so  it  can 
be  inferred  that  they  correctly  judged  the  fire  to  be  controllable. 

Evaluation  of  Situation  and  Selection  of  Action.  The  situation  was 
immediately  and  correctly  evaluated  and  the  extinguishing  action  was  successful. 
The  decision  to  divert  to  and  land  at  the  closest  appropriate  airfield  was  made 
in  a  timely  way  and  executed  according  to  specified  procedures.  No  emergency 
evacuation  was  ordered  because  the  fire  was  successfully  extinguished. 

Conclusions .  This  incident  was  dealt  with  and  in  keeping  with  specified 
procedures  and  the  fire  was  successfully  extinguished  while  an  appropriate 
emergency  diversion  was  being  accomplished. 
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SCENARIO  5  -  ACES  ANALYSIS.  In  this  scenario  a  lavatory  fire  is  detected, 
emergency  procedures  are  initiated  and  the  fire  is  extinguished  while  inflight. 
The  flight  was  diverted  to  the  nearest  appropriate  field.  The  ACES  system 
would  likely  have  detected  this  incident  earlier  than  the  human  and  existing 
sensor  detection  that  actually  took  place.  The  ACES  logic  would  have  been 
applied:  sensing  of  smoke,  determination  of  a  positive  rate  of  rise  in  smoke, 
and  a  forecast  of  exceeding  the  redline.  Since  the  fire  had  not  developed 
beyond  a  state  that  was  controllable  by  hand-held  extinguishers,  it  was 
apparently  not  active  or  rapidly  developing.  The  few  minutes  more  time  that  an 
ACES  would  have  provided  would  not  have  materially  changed  this  situation.  It 
must  be  noted  that  in-flight  fire  suppression  can  at  best  be  considered  a 
holding  action  while  the  flight  is  being  diverted  and  put  on  the  ground  as 
quickly  as  possible.  This  lavatory  fire  (as  any  in-flight  fire)  could  have  grown 
beyond  the  capability  of  the  available  hand-held  extinguishers.  Early,  positive, 
alarms  always  provide  more  time  for  planning  and  executing  an  emergency 
diversion  as  well  as  time  for  direct  attack  on  the  fire.  The  ACES  would 
therefore  have  provided  an  added  margin  of  time  which  would  have  been  an 
additional  safety  factor. 
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TABLE  5.  SCENARIO  5  -  TIMELINE  SUMMARY 
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smoky  activated  information 


SCENARIO  6  -  LIGHTING  BALLAST  OVERHEAT. 

SCENARIO  6  -  DESCRIPTION.  A  wide  body  four-engine  jet  aircraft  was  en 
route  San  Francisco  to  New  York  at  Flight  Level  370.  Local  time  was  2030;  meal 
service  had  just  been  completed  and  the  cabin  prepared  for  the  remainder  of 
the  flight.  The  fi  ght  was  on  time  and  on  the  filed  flight  plan.  The  outboard 
cabin  overhead  lights  were  on;  the  aisle  overhead  lights  were  dimmed.  At  2035 
a  passenger  reported  to  a  Flight  Attendant  that  he  smelled  the  odor  of 
overheating  electrical  equipment.  That  Attendant  then  directed  a  second 
Attendant  to  notify  the  flight  deck  and  began  to  search  for  the  source  of  the 
odor.  It  was  strongest  in  the  area  of  Row  12,  just  ahead  of  the  passenger  who 
had  reported  an  odor.  There  was  no  visible  smoke  and  no  part  of  the  overhead 
or  wall  lining  was  hot  to  the  touch.  She  then  went  to  the  Flight  Attendants' 
Panel  (at  2039)  and  turned  off  the  section  of  overhead  lights  in  the  area  of  Row 
12.  She  reported  her  observation  and  action  to  the  Captain  who  directed  the 
Flight  Engineer  to  pull  the  related  circuit  breaker.  The  Captain  also  directed 
that  the  flow  rate  of  cabin  air  be  increased.  The  Flight  Attendant  was  told  to 
keep  the  area  of  Row  12  under  surveillance  and  keep  the  flight  deck  informed. 
The  flight  continued  without  another  incident.  Maintenance  at  New  York 
removed  and  replaced  the  defective  ballast  and  the  aircraft  was  returned  to 
service . 

SCENARIO  6  -  FIRE  NARRATIVE.  This  incident  resulted  in  overheating 
electrical  equipment,  however,  no  actual  fire  started. 

SCENARIO  6  -  PROBLEM  ANALYSIS. 

Background.  This  incident  involved  a  defective  lighting  ballast  which 
overheated,  giving  off  a  burning  odor.  The  situation  was  quickly  detected  and 
appropriate  action  was  taken. 

Detection  of  the  Fire.  In  this  incident  there  was  no  actual  fire.  The 
overheated  ballast  was  detected,  by  odor,  apparently  very  soon  after  it  had 
begun  to  overheat. 

Localization  of  the  Fire.  The  location  of  the  ballast  was  quickly  and  easily 
determined  by  the  Attendant  and  the  passenger. 

Identification  of  Fire  Severity.  The  Attendant  correctly  determined  that 
the  source  was  an  overheating  ballast  and  that  its  severity  was  not  significant. 

Evaluation  of  the  Situation  and  Selection  of  Action.  The  overheating 
problem  was  correctly  assessed  as  non-significant  provided  that  the  power  was 
shut  off.  This  was  done  and  the  problem  was  effectively  resolved. 

Conclusions.  This  incident  was  correctly  and  efficiently  handled.  Power 
was  shut  off  at  the  Attendant's  panel  and  subsequently  the  related  breaker  was 
pulled:  a  redundant  shut-down  which  ensured  that  power  would  not  easily  be 
reapplied. 
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SCENARIO  6  -  ACES  ANALYSIS.  This  incident  involved  an  overheated  lighting 
ballast.  The  ACES  system  in  its  most  basic  concept  would  not  be  involved  in 
such  an  incident.  The  failure  would  be  detectable  by  other  means  as  in  the 
scenario  when  a  passenger  detected  the  odor.  A  more  elaborately  structured 
ACES  could  possibly  have  detected  heat  and/or  particulate  in  the  "attic"  area  of 
the  aircraft  and  might  have  detected  current  changes  from  the  data  bus.  Any 
benefit,  however,  from  detecting  the  incident  slightly  earlier  can  at  best  be 
deemed  marginal. 
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TABLE  6.  SCENARIO  6  -  TIMELINE  SUMMARY 


SCENARIO  7  -  AVIONICS  COMPARTMENT  SMOKE. 

SCENARIO  7  -  DESCRIPTION.  On  a  flight  from  Newark  International  to 
Dallas-Fort  Worth,  a  narrow  body  twin-jet  aircraft  was  dispatched  from  the  gate 
at  1328  local  time.  There  were  120  passengers  on  board  and  a  crew  of  seven 
(Captain,  First  Officer  and  5  Flight  Attendants).  The  flight  was  airborne  at 
1339  and  vectored  to  en  route  air  traffic  control  at  1350  at  flight  level  250  , 
climbing  between  Allentown  and  Philadelphia.  Upon  reaching  flight  level  310  at 
1358,  all  checklists  had  been  completed;  meal  service  including  a  hot  sandwich 
choice  was  initiated. 

The  flight  proceeded  routinely  with  no  deviation  from  the  flight  plan  and  no 
unusual  events  or  indications.  Just  prior  to  1530  when  the  flight  was 
approaching  the  Nashville  area,  the  First  Officer  reported  the  odor  of 
overheating  electrical  equipment.  The  Captain  and  First  Officer  scanned  all 
operational,  status  and  warning  indicators  and  found  no  abnormal  indications. 

At  1530  the  avionics  smoke  detector  alarmed  and  the  master  warning  was 
activated.  At  1531  smoke  appeared  on  the  flight  deck  apparently  rising  from 
below  the  floor  at  the  aft  end  of  the  cockpit.  The  flight  deck  crew  donned 
oxygen  masks  and  smoke  goggles  and  went  on  100%  oxygen.  The  master  warning 
was  reset  and  all  other  cockpit  indicators /displays  were  again  reviewed  and  no 
abnormal  indications  were  noted.  The  smoke  had  increased  in  density.  At 
1532,  the  First  Officer  located  the  Checklist  for  Electrical  Fire  and  Smoke  and 
with  the  Captain  completed  the  checklist.  The  Captain  called  the  Flight 
Attendant  in-charge  and  inquired  if  smoke  was  visible  or  could  be  smelled  in 
the  cabin  and  was  told,  not  at  the  moment.  He  advised  the  cabin  crew  not  to 
open  the  cockpit  door.  At  1533  the  intensity  of  the  smoke  continued  increasing 
slowly.  The  Captain  initiated  the  Smoke  Removal  Checklist.  The  increased 
ventilation  removed  smoke  although  it  appeared  that  the  source  of  smoke  had 
not  been  affected  by  turning  the  utility  bus  switches  off.  The  Flight 
Attendants  reported  that  smoke  had  become  apparent  in  the  cabin,  the  odor  had 
been  detected  but  no  visible  signs  were  present. 

At  1534  the  Captain  declared  an  emergency  to  ATC  and  requested  immediate 
direct  clearance  to  Nashvil  a,  which  was  designated  on  the  Flight  Management 
System  (FMS)  display  as  an  appropriate  diversion  field.  He  directed  the  First 
Officer  to  shut  down  all  avionics/ communication  equipment  not  needed  for  an 
emergency  approach  and  landing.  The  First  Officer  located  the  printed 
electrical  equipment  abnormal  shut-down  procedure  and  initiated  it.  ATC 
vectored  the  flight  through  a  manually-controlled  descent  to  the  Nashville  area. 
The  smoke  on  the  flight  deck  continued  to  be  heavy  and  visibility  was  reduced 
but  the  instrument  panel  was  visible  and  adequate  outside  visibility  was 
maintained.  At  1538  having  reached  3000  feet,  the  Captain  reduced  power  to 
minimum  air  speed  and  directed  the  First  Officer  to  open  his  side  window  to 
evacuate  smoke.  The  smoke  began  to  dissipate.  The  First  Officer  confirmed 
that  full  rate  cabin  air  exchange  was  operating.  He  inquired  as  to  cabin 
conditions  and  the  Chief  Flight  Attendant  reported  that  the  odor  of  smoke 
was  detectable  and  smoke  had  become  visible  in  the  area  of  the  flight  deck. 

She  requested  and  was  granted  permission  to  move  all  passengers  aft. 

At  1540  ATC  handed  the  flight  over  to  the  Nashville  tower  which  confirmed 
radar  contact.  The  Captain  directed  the  cabin  crew  to  brief  the  passengers  on 
maximum  effort  stop  after  landing  and  emergency  evacuation.  Smoke  in  the 
cockpit  had  diminished  but  there  appeared  to  be  a  persistent  source  of  at  least 
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moderate  smoke.  The  First  Officer  had  opened  a  cockpit  window  but  closed  it 
periodically  because  of  the  noise  which  interfered  with  voice  communication.  At 
1542  the  flight  began  a  straight-in  final  approach.  Nashville  tower  confirmed 
visual  contact  and  notified  the  flight  that  AFRR  vehicles  had  been  deployed  to 
the  landing  runway  area.  Touchdown  was  at  1544.  At  1546  the  Emergency 
Engine  Shut-Down  Checklist  was  completed  and  emergency  evacuation  slides 
were  deployed.  All  passengers  and  crew  exited  the  flight  with  only  minor 
injuries . 

The  avionics  bay  was  accessed  by  fire-fighting  personnel  who  found  charred 
insulation  (with  slight  residual  smoking)  related  to  one  of  the  navigation 
computers . 

SCENARIO  7  -  FIRE  NARRATIVE.  At  approximately  1527  an  unknown  electrical 
malfunction  resulted  in  the  overheating  of  a  wire  in  the  circuit  of  one  of  the 
navigation  computers.  Smoke  from  the  overheated  wire  accumulated  within  the 
equipment  cabinet  and  spread  to  the  avionics  bay  (Figure  9A).  The 
temperature  within  the  avionics  bay  stayed  relatively  constant,  since  the  limited 
heat  produced  by  the  overheated  wire  remained  localized  within  the  navigational 
computer.  At  1530  the  First  Officer  detected  the  odor  of  overheating  electrical 
equipment  and  a  minute  later  he  detected  visible  smoke  on  the  Flight  Deck. 
Also  at  1530  the  smoke  detector  located  at  the  ceiling  in  the  avionics  bay 
sounded  an  alarm.  At  this  point,  conditions  of  marginal  visibility  existed  in 
the  avionics  bay  and  the  smoke  continued  to  accumulate  in  the  cockpit  (Figure 
9B).  At  1533  the  odor  of  smoke  was  detected  in  the  passenger  cabin  and 
marginal  visibility  (heavy  smoke,  but  instrument  panel  still  visible)  was  reached 
in  the  cockpit  (Figure  9C).  Conditions  deteriorated  in  the  avionics  bay  to 
nearly  total  obscuration.  At  1540  smoke  continued  to  accumulate  on  the  flight 
deck  despite  intermittent  opening  of  the  First  Officer's  window  to  ventilate 
smoke.  At  1544  the  aircraft  touched  down  and  after  a  maximum  effort  stop  and 
passenger  evacuation  only  residual  smoke  remained.  The  smoke  signatures  are 
shown  in  Figure  10. 

SCENARIO  7  -  PROBLEM  ANALYSIS. 

Background.  This  incident  involved  electrical/ electronic  equipment 
overheat;  it  is  likely  that  no  open  flame  was  involved  although  a  large  amount 
of  smoke  was  generated.  The  flight  was  a  relatively  short  one  and  the  incident 
occurred  about  midway  to  the  destination  when  the  flight  was  over  an  area  in 
which  several  alternate  airfields  were  available.  The  incident  was  handled 
effectively . 

Detection  of  the  Fire.  Initial  detection  in  this  incident  was  by  the  odor  of 
smoke  in  the  cockpit  and  then  by  a  compartment  smoke  detector  and  the 
appearance  of  smoke  on  the  flight  deck  almost  simultaneously.  Detection  most 
likely  occurred  very  soon  after  the  overheat  began  to  produce  smoke. 

Localization  of  the  Fire.  Because  it  was  detected  by  a  compartment 
sensor,  the  location  of  the  incident  was  known  immediately.  More  exact  location 
within  the  compartment  would  have  required  opening  the  hatch  to  the  avionics 
bay  which  would  have  taken  time  and  disrupted  passengers  and  crew. 
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FIGURE  9C.  SMOKE  IS  HEAVY  IN 

COCKPIT,  FILLS  AVIONICS 
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Identification  of  Fire  Severity.  Severity  of  this  incident  was  assessed 
indirectly  by  systematically  removing  loads  on  the  electrical  system.  Turning 
the  utility  buses  off  did  not  noticeably  reduce  the  apparent  smoke.  Therefore 
the  Captain  ordered  all  electrical  equipment  turned  off  except  for  the  equipment 
absolutely  necessary  for  emergency  approach  and  landing.  This  did  result  in  a 
reduction  of  the  quantity  of  smoke. 

Evaluation  of  the  Situation  and  Selection  of  Action.  The  Captain's 
evaluation  was  that  the  alarm  and  the  presence  of  smoke  indicated  a  severity 
warranting  an  emergency  landing.  The  Captain  initiated  specified  procedures 
including  use  of  oxygen,  goggles,  equipment  shutdown  and  diversion  to  closest 
appropriate  airfield.  All  of  this  was  done  correctly  and  in  a  timely  way. 

Conclusions.  This  incident  was  handled  according  to  specified  procedures 
and  all  responses  were  made  promptly  and  correctly.  Because  the  avionics  bay 
is  not  readily  accessible  in  flight,  precise  and  selective  equipment  shutdown  was 
not  possible. 

SCENARIO  7  -  ACES  ANALYSIS.  In  this  scenario,  smoke  was  generated  by 
overheating  of  avionics  equipment  in  a  compartment  under  the  flight  deck.  The 
overheating  was  localized  and  not  sufficient  to  "pop"  a  circuit  breaker.  This  is 
an  unusual  scenario  in  that  load  shedding  did  not  reduce  the  overheating. 
Also,  no  active  burning  developed — even  though  the  overheating  persisted.  It 
is,  however,  not  a  wholly  improbable  scenario:  the  affected  equipment  was 
apparently  critical  and  thus  not  shut  down  in  load  shedding.  The  heat 
production  had  apparently  stabilized  at  a  level  just  below  the  breaker 
threshold. 

In  this  situation,  the  ACES  system  would  have  sensed  smoke  at  about  1527. 
Almost  immediately,  a  positive  rate  of  rise  in  smoke  would  have  been  determined 
but  little  heat  change  would  have  been  sensed.  The  ACES  system  would  then 
have  indicated  a  smoke  alert  condition,  reset  the  heat  redlines  and  continued 
to  monitor  for  circumstantial  evidence.  At  about  1528  the  ACES  would  have 
determined  a  growing  rate  of  rise  in  smoke  and  denoted  a  smoke  alarm 
condition. 

Given  the  earlier  alert  in  the  ACES  system,  the  crew  could  have  initiated  smoke 
removal  procedures  earlier  and  perhaps  have  reduced  the  amount  of  smoke  in 
the  cockpit.  In  addition  to  quicker  alerting,  the  ACES  would  have  provided 
more  efficient  ac.ess  to  the  appropnate  emergency  procedures.  There  are  no 
other  direct  benefits  from  the  ACES  system  in  this  particular  scenario. 
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flight  PHASE  Cruise  Cruise  Cruise  Cruise  Cruise  Cruise  Descent  Landing 


SCENARIO  8  -  CONCEALED  FIRE  (CLOSET). 


SCENARIO  8  -  DESCRIPTION.  On  a  flight  from  Miami  International  to  New 
York,  JFK,  a  wide  body  twin-jet  aircraft  was  dispatched  from  the  gate  at  2230. 
All  pre-flight  inspections  and  checklists  showed  everything  to  be  normal  and 
the  Pre-Takeoff  Checklist  was  initiated  while  taxiing  to  the  runway.  The 
Pre-Takeoff  Checklist  was  completed  with  no  deviations  and  the  flight  was 
airborne  at  2242. 

The  flight  was  in  a  single-class  configuration  and  carried  a  full  load  of  230 
passengers  during  the  heavy  traffic  period  at  the  end  of  the  winter  season. 
The  crew  consisted  of  Captain,  First  Officer  and  8  Attendants.  There  was  an 
unusually  large  amount  of  carry-on  luggage  and  clothing.  The  overhead  bins 
and  all  of  the  clothes  closets  were  filled.  The  folding  closet  doors  were 
secured  during  flight  and  normally  would  not  be  opened  until  after  landing. 
The  flight  proceeded  normally  for  the  first  half  of  the  scheduled  three-hour 
trip.  A  drink  and  snack  service  had  been  completed  and  there  was  little  or  no 
passenger  movement  in  the  cabin.  At  0012  a  passenger  in  the  first  row,  right 
side  detected  the  odor  of  smoke  and  notified  a  Flight  Attendant.  The  Attendant 
observed  a  light  flow  of  smoke  issuing  from  the  top  of  the  door  to  the  closet 
forward  of  the  passenger  seating  area  on  the  left  side  of  the  aircraft.  This 
closet  is  adjacent  to  the  front,  left  passenger  entrance  and  opposite  the  forward 
lavatory.  At  this  location,  a  cross  aisle  is  formed  between  the  passenger 
entrance  and  the  service  accessway  on  the  right  side  of  the  aircraft. 

The  Attendant  opened  the  closet  door  only  enough  to  see  that  the  closet  was 
filled  with  whitish  smoke  having  an  acrid  odor — a  large  amount  of  smoke  spilled 
into  the  cabin.  The  Attendant  closed  the  closet  and  went  into  the  cockpit  to 
inform  the  Captain  at  0013.  The  Captain  called  the  Senior  Flight  Attendant 
forward  and  directed  that  an  extinguisher  be  discharged  into  the  closet.  He 
also  directed  that  the  curtain  between  the  passenger  seats  and  the 
closet /lavatory  area  be  closed.  One  Attendant  was  directed  to  remain  at  the 
cockpit  area  for  communication;  one  was  directed  to  attempt  to  determine  the 
exact  location  and  extent  of  the  fire  within  the  closet.  Two  Attendants  were 
directed  to  remain  in  the  passenger  area  to  reassure  and  help  the  passengers. 
The  first  extinguisher  was  discharged  at  0014. 

The  Captain  and  First  Officer  consulted  briefly  and  decided  to  declare  an 
emergency  which  the  Captain  announced  to  ATC  at  0017.  The  Captain  and 
First  Officer  donned  smoke  goggles  and  oxygen  masks  at  100%  oxygen,  the 
Attendant  at  the  cockpit  door  donned  a  smoke  mask  and  a  portable  oxygen 
bottle.  Additional  fire  extinguishers  were  brought  forward  and  the  Attendant 
at  the  closet  began  removing  the  contents  and  used  a  second  extinguisher  at 
about  0018.  The  Attendant  reported  that  there  was  no  visible  flame  and  that 
the  smoke  was  heavy  but  that  it  appeared  not  to  be  increasing.  Meanwhile,  the 
Captain  had  initiated  an  emergency  descent  and  the  flight  was  passing  through 
Flight  Level  270.  ATC  granted  clearance  direct  Raleigh-Durham  at  0019  which, 
at  that  time,  was  approximately  70  miles,  on-course.  Clearance  was  given  for 
an  emergency  approach;  all  affected  traffic  was  notified  and  Raleigh-Durham 
began  to  deploy  ARFF  vehicles  to  the  landing  runway. 

The  passengers  were  attempting  to  move  away  from  the  smoke  in  the  front  end 
and  the  Attendants  in  the  cabin  were  busy  trying  to  keep  the  passengers  calm 
and  orderly. 
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At  0020,  descending  through  14,000  feet,  the  Captain  directed  the  First  Officer 
to  depressurize  the  aircraft  and  confirm  that  the  outflow  valves  were  fully 
opened.  Passengers  were  directed  back  to  their  seats  with  seat  belts  fastened. 

At  10,000  feet  the  Senior  Attendant  informed  the  Captain  that  there  was  no 
visible  fire.  At  0022  the  Captain  initiated  and  directed  the  Cabin  Smoke 
Evacuation  Procedure.  Substantial  clearing  of  smoke  was  achieved  and  no 
visible  fire  was  detected. 

The  flight  touched  down  at  0029  and  a  maximum  effort  stop  was  made. 
Emergency  evacuation  chutes  were  deployed  and  all  passengers  and  crew  safely 
exited  the  aircraft  at  0034.  There  were  only  minor  injuries,  but  at  least  half  of 
the  passengers  were  given  some  treatment  for  smoke  inhalation. 

SCENARIO  8  -  FIRE  NARRATIVE.  At  approximately  0008  a  smoldering  fire  of 
undetermined  origin  began  in  the  carry-on  luggage  in  the  forward  left  clothes 
closet  (Figure  11A).  As  the  smoke  accumulated  in  the  closet,  it  leaked  out  of 
the  top  of  the  folding  door  and  mixed  with  the  circulating  air  in  the  passenger 
compartment  and  became  somewhat  diluted  (Figure  11B).  At  0012  a  passenger 
detected  the  smoke  odor  and  notified  a  Flight  Attendant.  A  large  amount  of 
smoke  spilled  into  the  cabin  when  the  Flight  Attendant  opened  and  closed  the 
closet  door  during  her  investigation  (Figure  11C).  The  temperature  within  the 
closet  had  risen  only  slightly  above  ambient  to  about  90°F.  At  0014  the  Flight 
Attendant  again  opened  the  closet  door  and  discharged  a  fire  extinguisher  into 
the  stacked  luggage  and  closed  the  door.  By  0015  the  temperature  within  the 
closet  reached  approximately  100°-150°  at  the  ceiling.  At  approximately  0017, 
the  Attendant  again  opened  the  closet  door  and  after  removing  some  of  the 
clothes  and  luggage,  discharged  a  second  fire  extinguisher  and  reported  no 
visible  flame.  However,  smoke  was  still  heavy.  By  0019  smoke  in  the  forward 
end  of  the  passenger  cabin  was  heavy.  At  0020  the  First  Officer  initiated 
smoke  evacuation  procedures  by  opening  the  outflow  valves  followed  by  the 
Captain's  initiation  of  the  Cabin's  Smoke  Evacuation  Procedure.  At  0024  the 
smoke  had  cleared  substantially.  At  no  time  were  visible  flames  detected.  At 
0029  the  aircraft  touched  down  with  little  visible  smoke  and  the  temperature  had 
returned  to  ambient.  The  smoke-temperature  signatures  are  shown  in  Figure 
12. 

SCENARIO  8  -  PROBLEM  ANALYSIS. 

Background.  This  fire  occurred  about  half  way  through  a  scheduled 
three-hour  flight.  It  was  a  smoldering  fire  in  a  closet  which  contained  coats  as 
well  as  hanging  luggage.  It  was  not  possible  to  determine  the  exact  source, 
but  it  was  most  likely  smoking  material  left  in  a  coat  while  still  lighted  or  a 
spontaneous  combustion  of  some  flammable  material.  The  incident  took  place 
over  an  area  in  which  there  are  several  available  alternate  airfields. 

Detection  of  the  Fire.  Initial  detection  was  by  a  passenger  who  smelled 
smoke;  an  Attendant  investigated  and  found  smoke  issuing  from  the  closet. 
This  initial  detection  took  place  when  the  fire  had  smoldered  for  a  relatively 
long  time.  Smoke  and/or  heat  detectors  in  the  closet  would  have  probably 
detected  the  incident  sooner. 

Localization  of  the  Fire.  The  site  of  this  incident  was  quickly  and  easily 
determined  when  the  smoke  was  detected.  The  location  was  confirmed  when  the 
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FIGURE  11A.  SMOLDERING  FIRE  FIGURE  11B.  SMOKE  LEAKS  FROM 

IN  CLOSET  CLOSET,  IS  DETECTED  IN 

PASSENGER  CABIN 


FIGURE  11C.  SMOKE  IN  PASSENGER  CABIN 
INCREASED  BY  OPENING/ 
CLOSING  CLOSET  DOOR 
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FIGURE  12.  SCENARIO  8:  SMOKE-TEMPERATURE  SIGNATURES 


closet  contents  were  removed  to  apply  the  extinguishing  agent.  Until  that  was 
done,  the  possibility  existed  that  the  fire  was  remote  from  the  closet  and  that 
the  smoke  was  simply  moving  through  and  out  of  the  closet. 

Identification  of  Fire  Severity.  While  the  issue  of  severity  was  not 
explicitly  addressed  in  the  course  of  this  incident,  the  description  of  the 
smoke/fire  given  to  the  Captain  led  him  to  order  the  use  of  extinguishers.  The 
suggestion  is  clear  that  he  assessed  the  severity  as  being  beyond  a  simpler 
response  (such  as  beating  out  a  glowing  ember). 

Evaluation  of  Situation  and  Selection  of  Action.  The  Captain  evaluated  the 
situation  as  being  severe  enough  to  warrant  the  use  of  extinguishers  and  the 
immediate  diversion  of  the  flight  to  the  nearest  appropriate  airfield.  This 
assessment  was  made  quickly  and  was  appropriate.  Subsequent  actions:  to 
divert,  to  ventilate  the  smoke  and  finally  to  conduct  an  emergency  evacuation, 
were  also  timely  and  appropriate. 

Conclusions .  This  incident  was  handled  in  an  effective  and  timely  way  by 
the  crew.  Earlier  detection  might  have  resulted  in  less  smoke  accumulation 
which  might  have  made  the  ventilation  and  the  emergency  evacuation 
unnecessary. 

SCENARIO  8  -  ACES  ANALYSIS.  This  scenario  involves  a  smoldering  tire  in  a 
clothes  closet  presumably  ignited  by  lighted  smoking  material  accidentally  left  in 
a  passenger's  coat  or  luggage.  Actual  detection  was  by  a  passenger  who 
detected  the  odor  of  smoke.  It  is  shown  in  the  fire  narrative  that  smoke  was 
generated  as  early  as  nine  minutes  after  midnight — 0009.  The  ACES  system 
would  have  sensed  smoke  at  that  time  and  would  have  almost  immediately 
determined  a  positive  and  growing  rate  of  rise  in  smoke.  This  would  have 
generated  a  s  ike  alert  and  the  ACES  would  have  reset  the  heat  redline. 
Meanwhile,  the  overall  heat  in  the  closet  had  not  yet  increased  over  ambient. 
The  ACES  smoke  detector  would  have  determined  a  continued  positive  rate  of 
rise.  The  rate  was  initially  growing  slowly  but  at  about  0012  it  began  to  grow 
rapidly.  The  ACES  system  would  have  issued  a  smoke  alarm  at  about  0011  or 
0012.  (This  is  approximately  the  same  time  that  the  passenger  actually  noticed 
the  smoke  odor.)  When  the  ACES  went  into  smoke  alarm  it  would  have  also 
provided  the  precise  location  of  the  incident  and  forced  the  display  of 
appropriate  emergency  procedures. 

The  ACES  benefit  in  this  situation  is  primarily  that  the  location  is  identified 
and  that  the  procedures /checklists  are  made  immediately  available.  The  specific 
characteristics  of  this  incident  are  such  that  the  ACES  did  not  provide  an 
earlier  detection  than  did  the  "human  sensor" .  This  should  not  be  unexpected 
in  incidents  that  occur  in  or  near  occupied  spaces.  It  must  be  remembered, 
however,  that  prompt,  reliable  detection  of  an  incident  in  any  not  readily 
accessible  space  such  as  a  closet  could  provide  a  very  valuable  amount  of  time 
for  emergency  response. 
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SCENARIO  9  -  AIR  CONDITIONING  PACK  SMOKE. 


SCENARIO  9  -  DESCRIPTION.  A  narrow  body  twin-jet  aircraft  was  scheduled 
to  operate  from  Kansas  City  International  to  Seattle/ Tacoma  with  a  full 
passenger  load.  Departure  was  scheduled  for  2200  hours  and  the  pushback  was 
on  schedule.  After  a  normal  departure,  the  flight  was  cleared  by  ATC  to  flight 
level  (FL)  310  for  the  cruise  portion. 

At  2305  the  cabin  rapidly  began  to  fill  with  acrid,  oily-smelling  smoke  later 
found  to  be  frcm  the  left  air  conditioning  pack.  The  flight  crew  received 
notice  of  the  smoke  in  the  passenger  cabin  at  2306  when  the  Flight  Attendant 
from  first  class  entered  the  cockpit  with  a  report  of  smoke  of  unknown  type 
and  origin  and  the  Attendants  in  the  aft  cabin  called  on  the  intercom. 

The  Captain  immediately  directed  the  First  Officer  to  determine  if  an  electrical 
failure  was  the  source  of  the  smoke.  He  also  instructed  the  Attendant  in  the 
aft  cabin  to  remain  on  the  intercom  and  the  Attendant  from  the  forward  cabin  to 
return  to  calm  the  passengers.  He  made  sure  that  the  cockpit  door  was 
securely  fastened.  The  First  Officer  scanned  the  overhead  panel  to  check  for  a 
tripped  circuit  breaker.  He  found  none.  At  2308  he  reported  to  the  Captain 
that  all  circuit  breakers  were  in. 

The  Captain  immediately  inquired  of  the  Attendant  on  the  intercom  whether  any 
fire  source  was  visible.  Upon  receiving  a  negative  response,  he  announced  to 
the  First  Officer  that  he  suspected  an  air  conditioning  pack  problem.  Together 
they  scanned  the  instruments  looking  for  a  problem  sign.  At  2310  the  Captain 
initiated  the  Air  Conditioning  Pack  Checklist  which  included  shutting  off  the 
right-hand  pack.  He  also  notified  ATC  of  the  situation  asking  that  lower 
altitudes  be  cleared  and  requested  a  report  of  landing  conditions  at  Denver,  the 
nearest  airport  at  which  his  company  had  operations. 

At  2312  the  Attendants  reported  a  dramatic  increase  in  smoke.  At  the  same 
time,  the  trip  reset  switch  for  the  left-hand  pack  tripped.  The  Captain 
correctly  interpreted  these  signs,  and  at  2313  ordered  the  right-hand  pack 
back  on  line  and  the  left  totally  shut  down.  He  then  requested  the  Smoke 
Removal  Checklist  which  the  First  Officer  retrieved  from  the  FCOM.  After 
donning  their  oxygen  masks  and  smoke  goggles  and  going  to  100  percent 
oxygen,  the  checklist  was  initiated.  It  was  interrupted  by  the  fire  warning 
indication  for  the  left  (No.  1)  engine. 

At  2315  the  Captain  ordered  the  engine  shut  down  and  the  discharge  of  both 
extinguisher  bottles  for  the  No.  1  engine.  He  then  notified  ATC  of  an 
emergency,  requested  immediate  clearance  to  a  lower  altitude  and  a  clearance 
direct  to  Denver. 

At  2316  the  flight  was  cleared  for  an  immediate  descent  to  10,000  feet  and  told 
to  standby  for  vectors  to  Stapleton  International.  The  Smoke  Removal  Checklist 
was  resumed  and  completed  at  2318.  The  Attendants  reported  that  the  smoke 
situation  had  stabilized,  but  that  some  passengers  were  complaining. 

At  2319  clearance  direct  to  Denver  was  received  and  the  Captain  was  asked 
whether  he  wanted  ARFF  equipment  to  meet  the  flight.  Still  uncertain  about 
the  cause  of  the  smoke  and  because  of  the  engine  fire  and  shutdown,  equipment 
was  requested.  Medical  support  was  also  requested  because  of  the  extensive 
passenger  smoke  inhalation. 


The  rapid,  single  engine  descent  in  mountainous  terrain  occupied  most  of  the 
crew’s  attention.  At  2326  the  flight  leveled  out  at  10,000  feet  and  the  outflow 
valves  opened  fully.  This  resulted  in  a  noticeable  reduction  in  smoke  density. 
Touchdown  occurred  at  2342  and  a  maximum  effort  stop  was  made  to  minimize 
the  time  until  the  doors  could  be  opened.  As  soon  as  the  aircraft  stopped,  the 
Captain  ordered  all  doors  opened,  but  chose  not  to  order  an  emergency 
evacuation.  Several  passengers  were  treated  for  smoke  inhalation  and  released. 

Subsequent  investigation  revealed  that  a  turbine  bearing  had  failed  and  the 
smoke  was  apparently  generated  by  overheating  lubricant  and  later  by 
overheated  insulation  and  plastic  components.  It  was  also  determined  that  there 
had  been  a  fire  involving  lubricating  oil  in  the  No.  1  engine;  and  that  fire  was 
extinguished  by  the  system  activated  by  the  Captain  at  2315. 

SCENARIO  9  -  FIRE  NARRATIVE.  The  scenario  consists  of  two  separate 
unrelated  smoke  and  fire  conditions  which  occurred  during  the  flight.  For  this 
study's  purposes,  only  the  air  conditioning  pack  smoke  narrative  is  described. 

In  this  incident  there  was  no  fire.  The  smoke  that  appeared  in  the  cabin  was 
generated  by  the  failure  of  a  turbine  fan  bearing.  Initially,  the  bearing 
overheated  causing  the  lubricant  to  smoke.  Eventually  the  bearing  seized  and 
insulation  and  plastic  components  in  and  adjacent  to  the  turbine  became 
overheated  producing  additional  smoke.  The  trip  reset  switch  was  tripped  by 
the  short  circuiting  in  the  pack  motor.  The  smoke  signatures  of  this  incident 
are  shown  Figure  13. 

SCENARIO  9  -  PROBLEM  ANALYSIS. 

Background.  This  incident  was  the  result  of  two  unrelated  events  which 
together  created  an  unusually  stressful  and  potentially  hazardous  situation. 
Smoke  was  distributed  throughout  the  aircraft  more  or  less  uniformly  leading  to 
the  diagnosis  of  a  fault  in  an  air  conditioning  pack.  Since  there  was  no  failure 
indication,  the  Captain  followed  specified  procedures  and  as  a  consequence  shut 
down  the  right-hand  pack.  The  smoke  situation  continued  to  worsen  and  the 
left-hand  pack  reset  switch  tripped.  The  right-hand  pack  was  then  restored  to 
service  by  the  Captain  who  also  ensured  that  the  failed  left-hand  pack  was 
totally  shut  down.  At  this  time  the  second  event  occurred:  Number  One  Engine 
Fire  Warning  was  activated.  The  appropriate  engine  fire  and  shutdown 
procedures  were  employed.  Smoke  persisted  in  the  cabin  and  with  one  pack 
inoperative,  the  remaining  pack  could  not  quickly  ventilate  the  cabin.  In 
addition,  the  burden  of  making  a  single-engine  emergency  descent,  approach 
and  landing  greatly  increased  workload  and  stress  on  the  Captain  and  First 
Officer.  This  incident  occurred  over  mountainous  terrain  where  only  one 
alternate  airfield  was  reasonably  available. 

Detection  of  the  Fire.  Initial  detection  of  the  pack-related  event  was  by 
the  appearance  of  smoke  in  the  cabin.  While  it  was  assumed  that  a  pack  was 
the  source,  there  was  no  positive  detection /location  of  the  incident  until  the 
left-hand  pack  reached  a  state  that  tripped  its  reset  switch.  (This  occurred 
seven  minutes  after  smoke  first  appeared.)  Meanwhile,  specified  procedures 
had  resulted  in  the  right-hand  pack  having  been  shut  down.  When  the  switch 
tripped,  this  situation  was  corrected  and  the  smoke  quantity  began  to  stabilize 
and  eventually  diminish. 
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FIGURE  13.  SCENARIO  9:  SMOKE  SIGNATURES 


Detection  of  the  second  event  (engine  fire)  was  by  means  of  the  fire  warning 
indicator  which  triggered  the  appropriate  emergency  response  by  the  crew. 

Localization  of  the  Fire.  The  initial  response  was  to  shut  down  the 
right-hand  pack,  in  conformance  with  specified  procedures.  Since  the  problem 
was  actually  in  the  left-hand  pack,  that  response  did  not  affect  the  smoke.  As 
evident  here,  there  are  abnormal  situations  that  produce  smoke  before  a  pack 
failure  is  indicated.  The  specified  procedure  in  this  situation  is  to  shut  down 
the  right-hand  pack  first,  essentially  as  a  trial  or  diagnostic  step.  It  was  only 
when  the  reset  switch  tripped  that  positive  localization  was  possible.  The 
engine  fire,  of  course,  was  detected  and  located  by  the  Firing  Warning  alarm. 

Identification  of  Fire  Severity.  In  this  incident  severity  as  such  was  not  a 
critical  issue:  once  the  malfunctioning  pack  was  identified  and  shut  down,  the 
movement  of  smoke  into  the  cabin  was  stopped.  Ventilation  by  means  of  the 
remaining  pack  was  accomplished  a*  the  full  capacity  of  that  pack  without 
regard  to  the  severity  of  the  event. 

Evaluation  of  Situation  and  Selection  of  of  Action.  In  this  incident  the 
immediate  evaluation — pack  problem — was  correct  and  timely.  The  response  of 
shutting  down  the  pack  which  was  not  the  source  was  made  by  procedure. 
There  was  no  possible  means  of  identifying  the  source  until  the  reset  tripped. 
All  other  actions  including  diversion,  maximum  effort  stop  and  opening  doors 
immediately  were  warranted  and  were  completed  successfully. 

Conclusions .  Even  though,  in  this  incident,  the  cabin  filled  with  smoke 
which  proved  difficult  to  ventilate,  all  of  the  responses  were  correct  and 
properly  executed.  Without  other  cues,  the  shutdown  of  the  wrong  air 
conditioning  pack  could  not  have  been  avoided.  Then  with  only  one  operative 
pack  there  was  only  limited  capacity  for  ventilating  the  smoke  from  the  cabin. 
The  response  to  the  engine  fire  warning  was  timely  and  correct. 

SCENARIO  9  -  ACES  ANALYSIS.  This  scenario  involved  two  separate  events: 
smoke  from  an  air  conditioning  pack  overheat  and  fire  in  the  No.  1  engine. 
The  former  event  is  of  direct  concern  to  an  ACES  system.  The  latter  is 
outside  the  ACES  system  definition  but  diverted  the  crew's  attention  from  the 
first  event,  thereby  affecting  their  response. 

The  ACES  system  would  have  sensed  smoke  at  about  2303  and  determined  almost 
immediately  a  positive,  growing  rate  of  rise  in  smoke.  This  would  have  been 
two  minutes  before  the  actual  visual  detection  took  place.  The  ACES  system 
would  have  initiated  a  smoke  alarm,  reset  the  heat  redline  and  forced  the 
display  of  appropriate  emergency  procedures  and  checklists. 

In  this  incident,  earlier  detection  by  ACES  (being  only  two  minutes)  is 
probably  of  itself  a  marginal  benefit.  By  locating  the  smoke  source  precisely, 
the  ACES  system  would  have  provided  substantial  benefit.  In  the  actual 
occurrence,  the  crew  shut  down  the  pack  that  was  not  overheating  thereby 
allowing  the  smoke  to  increase  significantly  and  continue  being  distributed 
throughout  the  cabin.  The  true  benefit  of  the  ACES  system,  then,  is  best 
expressed  in  terms  of  time  to  respond  correctly.  In  the  actual  event,  smoke 
appeared  at  2305  and  not  until  2313  was  the  malfunctioning  unit  shut  down. 
Thus,  for  eight  minutes  after  detection  smoke  continued  to  be  generated  and 
distributed  throughout  the  passenger  compartment.  Under  the  ACES  system, 
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the  source  would  have  been  identified  immediately  and,  allowing  one  minute  for 
response,  the  offending  unit  could  have  been  shut  down  at  about  2304.  This 
represents  about  nine  minutes  less  exposure  of  the  crew  and  passengers  and 
the  aircraft  to  the  noxious  smoke.  The  fire  narrative  indicates  that  those  nine 
minutes  included  the  time  of  most  intense  smoke  increase  which  only  compounds 
the  potential  benefit. 
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TABLE  9.  SCENARIO  9  -  TIMELINE  SUMMARY 


a 

at 

o 

CQ 

09 

AJ 

0 

AJ 

CO 

Aw 

CQ 

■o 

•w4 

CL 

u 

»“< 

at 

a 

>s 

AJ 

0 

O 

O 

(0 

w 

C 

at 

f-4 

a. 

0> 

x: 

*3 

a 

00 

cj 

at 

<0 

Aw 

E 

a; 

•a 

E 

Uw 

e 

c 

t— ( 

o 

0) 

<0 

»  «  o 

t* 


c  S  > 

•wJ  I  0)  «H  U 

DO  O  T3  0t 

C  Aw  •*  (U  > 

o  a  «)  i-  •*  c 

U  CO  >,  Of 

■u  0)  3  cj  O 

<AW  (-4  -o  cj  c 

a;  -»h  at  at  at  o 

j  ^  cj  *o  oo  -u 


M-»  to 

o  > 

m  o 

a  E  aj 

to  •*  o  a)  « 

a.  c  cfl  ac  — « 

o  a.  ^ 

aj  at  Od 

£  ^  u  U 

O0  U  ^  O  U 

s  2  a  A  6 


.*  i 

c  o  Jid 
5  to  cj 
O  o.  0) 

■a  ur 

4J  U 

AJ  JZ  AJ 

3  00  Aw  co 

jc  •*  a>  •*-* 
co  Aw  a.  ^ 


i 

•a 

c 

at 

•w 

c 

N 

-f-l 

•wW 

u 

Aw 

CO 

Qi 

3 

at 

cn 

co 

CO 

x: 

C0 

co 

CO 

at 

0) 

a; 

Qt 

E 

o 

Aw 

Aw 

Aw 

CO 

z 

o 

CL 

CO 

CO 

Aw 

c 

at 

o 

00 

•wW 

1 

c 

AJ 

c 

CO 

at 

CO 

at 

AJ 

C0 

od 

u 

AJ 

c 

*3 

C0 

a 

a t 

AJ 

<0 

c 

co 

co 

a. 

< 

■3 

CO 

CL 

a. 

o 

•<  w 
H  W  -J 
CO  CJ  0Q 

2:  z  < 

3  W  J 
U  Q  w 
os  -<  < 
*-*  >  :> 
|U  w  < 


z 

C  c*i 
M  a  j 

H  U  33 
CO  z  < 
=5  U3  -J 
CQ  Q  t-4 

z:  i-h  < 
o  >  > 
u  &  < 


at 

AJ 

at 

as 

CO 

AJ 

at 

r“W 

c 

f~w 

at 

.* 

00 

at 

C. 

CJ 

r— ' 

CJ 

E 

o 

at 

C*t 

co 

C 

E 

r-w 

at 

CJ 

CO 

CJ 

w 

Q 

— «  <v 
X  3  ^ 

U  u  n) 

at  ^  a; 

JZ  -*j  Li 

CJ  at  £2 


T3 

AJ 

at 

— w 

at 

a. 

U-, 

vO 

CQ 

**-w 

o 

*wW 

cj 

AJ 

rO 

3 

o 

o 

cs 

U 

CJ 

C 

'w' 

CJ 

c 

T3 

•wi 

at 

£1 

at 

at 

CJ 

C0 

CO 

CO 

Jd 

CJ 

© 

•f»w 

AJ 

m 

3 

§ 

o 

c 

cs 

A- 

C/3 

c 

— < 

CJ 

91 


SCENARIO  10  -  CONCEALED  FIRE  (CHEEK). 


SCENARIO  10  -  DESCRIPTION.  A  wide  body  tri-jet  aircraft  was  operating 
nonstop  from  Atlanta's  Hartsfield  International  to  Seattle /Tacoma  International 
with  198  passengers  and  a  crew  of  14  (3  flight  and  11  cabin).  The  flight 
departed  on  schedule  at  1000.  After  following  a  standard  instrument  departure, 
the  flight  was  cleared  to  flight  level  310  for  the  transcontinental  trip. 

Passenger  service  included  a  full  hot  meal.  This  was  to  be  heated  in  the  ovens 
in  the  lower  deck  galley  and  distributed  in  serving  carts.  Preparation  for  the 
meal  service  began  at  1130,  and  all  food  preparation  ended  by  1153. 

At  some  time  after  1130,  but  unknown  to  the  crew  or  passengers,  lint  and 
debris  in  the  fuselage  cheek  adjacent  to  a  galley  oven  began  to  smolder.  It 
was  later  determined  that  insulation  on  a  power  cable  had  been  accidentally 
nicked  and  there  had  been  intermittent  arcing.  This  arcing  ignited  the  debris 
in  the  cheek,  but  did  not  trip  a  circuit  breaker.  The  smoldering  then  became 
an  active  fire;  as  a  result  of  this  burning,  a  hydraulic  line  developed  a  small 
leak.  Hydraulic  fluid  escaped  and  began  to  burn  and  generate  a  large  volume 
of  smoke.  This  smoke  migrated  through  the  cheek  area  and,  at  1155  the  fire 
penetrated  the  galley  wall  allowing  smoke  to  pour  into  the  galley.  The  galley 
smoke  detector  tripped  at  1156  when  the  aircraft  was  160  miles  north  of  Omaha, 
Nebraska  (approximately  over  Sioux  City,  Iowa). 

Upon  receiving  the  galley  smoke  warning  in  the  cockpit,  the  Captain  confirmed 
that  no  one  was  in  the  galley  and  the  crew  began  to  execute  the  standard 
emergency  procedures.  The  First  Officer  retrieved  the  checklist  from  the 
FCOM  at  1157  and  called  for  shutting  down  the  galley  power  switches.  This 
was  immediately  done  by  the  Flight  Engineer.  They  then  proceeded  through 
the  remainder  of  the  checklist. 

At  1159  the  Captain  instructed  the  FV^ht  Engineer  to  don  his  smoke  mask  and 
oxygen  bottle  and  take  a  fire  extinguisher  down  the  lift  to  the  galley.  The 
Captain  then  notified  his  company's  operations  center  of  the  problem  and 
reported  the  situation  to  the  en  route  center.  At  1200,  in  response  to  a  lew 
pressure  alarm,  the  affected  hydraulic  system  was  shut  down. 

The  Flight  Engineer  complied  with  the  Captain's  directive  and  entered  the  galley 
at  1204.  He  checked  that  the  galley  ceiling  air  vents  were  open  and  then 
turned  his  attention  to  the  oven  area  from  which  the  smoke  was  emanating. 
Seeing  smoke  from  the  oven  areas,  he  discharged  the  fire  extinguisher  at  the 
ovens.  He  then  exited  the  galley  and  returned  to  the  cockpit  at  1210.  The 
Flight  Engineer  reported  to  the  Captain  that  he  thought  the  fire  was  under 
control.  At  the  same  time,  the  Senior  Flight  Attendant  called  the  cockpit  and 
said  he  could  see  smoke  in  the  galley-lift  shaft.  The  Captain  then  instructed 
the  Flight  Engineer  to  return  to  the  galley  for  an  additional  check. 

At  1228  the  Flight  Engineer  attempted  to  descend  the  lift  wearing  his  smoke 
mask  and  oxygen  bottle.  The  smoke  was  so  thick  that  he  could  not  see  when 
he  reached  the  galley.  He  groped  for  the  intercom  and  informed  the  Captain 
that  the  smoke  was  obviously  still  being  generated.  He  recommended  an 
immediate  landing  at  the  nearest  suitable  airport  and  maximum  electrical  load 
shedding  on  the  assumption  that  the  fire  was  electrical  in  origin.  At  this  time, 
the  flight  was  40  miles  due  east  of  Pierre,  South  Dakota  and  still  at  flight  level 
310. 
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The  Captain  instructed  the  First  Officer  to  execute  the  Smoke  Evacuation 
Checklist  and  begin  shedding  electrical  load  while  waiting  for  the  Flight 
Engineer  to  return.  He  then  contacted  the  en  route  center  and  notified  them  of 
the  emergency  and  his  desire  to  make  an  immediate  descent  to  land.  He 
received  immediate  clearance  to  16,000  feet  and  began  a  descent.  At  1232  the 
Captain  reached  for  his  charts  to  select  an  appropriate  landing  site.  As  he  xvas 
reading  the  charts,  the  Flight  Engineer  returned  to  the  cockpit.  The  Captain 
then  instructed  him  to  take  over  the  checklist  tasks  while  the  First  Officer 
notified  the  Cabin  Attendants  and  passengers.  The  Senior  Cabin  Attendant 
reported  only  minimal  smoke  in  the  passenger  areas,  but  it  was  not  certain  that 
the  fire  was  out. 

The  Captain  rejected  a  landing  at  Pierre,  the  nearest  field,  because  of 
inadequate  runway  length.  Rapid  City  was  also  rejected  as  inadequate  to 
handle  a  severe  emergency  to  a  plane  of  this  size.  Minneapolis/ St.  Paul  at  400 
miles  and  Omaha  at  340  miles  seemed  to  be  the  best  choices  for  commercial 
fields,  and  Ellsworth  Air  Force  Base  at  174  miles  was  the  closest  suitable  field. 
ATC  informed  the  Captain  that  the  weather  at  Omaha  was  marginal  with  solid 
overcast  at  1,200  ft  in  rain  squalls  and  fog.  Minneapolis  and  Ellsworth  showed 
acceptable  weather. 

With  most  power  shut  down  and  uncertainty  as  to  whether  the  smoke  source  had 
been  eliminated,  the  Captain  elected  to  land  at  Ellsworth.  He  requested 
clearance  for  a  direct  routing  and  a  precision  radar  approach.  ATC  told  him  to 
standby  at  1235.  The  Captain  told  the  First  Officer  to  contact  company 
operations  and  inform  them  that  he  was  going  to  Ellsworth.  He  also  requested 
the  Flight  Engineer  to  maintain  constant  intercom  communication  with  the  Senior 
Cabin  Attendant  to  provide  cabin  smoke  reports. 

At  1236  ATC  gave  vectors  for  Ellsworth  and  cleared  the  flight  for  an  immediate 
descent  at  Captain's  discretion  to  2,000  feet.  At  1238  ATC  informed  the 
Captain  that  Ellsworth  had  been  notified,  gave  the  Captain  the  Ellsworth  tower 
frequency  and  asked  if  the  Captain  was  requesting  equipment.  The  Captain 
declined  equipment  saying  that  he  thought  the  smoke  source  had  been 
eliminated. 

At  1242  the  Captain  contacted  Ellsworth  tower  and  again  declined  equipment. 
The  tower  confirmed  a  radar  contact  and  gave  him  vectors. 

At  1251  the  Flight  Engineer  told  the  Captain  that  the  smoke  had  definitely 
entered  the  cabin,  and  the  passengers  were  starting  to  complain.  The  Captain 
asked  if  there  were  any  visible  signs  of  fire  in  the  cabin  and  was  told  no.  He 
asked  for  regular  updates.  At  1253  he  told  the  First  Officer  to  notify  Ellsworth 
that  ARFF  equipment  would  be  required  and  that  he  was  planning  for  a 
maximum  effort  stop  and  emergency  evacuation.  He  then  asked  the  Flight 
Engineer  to  tell  the  Senior  Cabin  Attendant  to  come  forward  for  a  briefing. 

By  1259  the  crew  and  passengers  had  been  briefed  and  were  preparing  for  the 
emergency  landing  and  evacuation.  The  smoke  level  was  increasing  in  the 
center  of  the  aircraft  so  the  Attendants  moved  as  many  passengers  as  possible 
to  seats  forward  and  aft.  The  Captain  ordered  the  Flight  Crew  to  don  oxygen 
masks  and  go  on  100  percent  oxygen  even  though  there  was  no  smoke  in  the 
cockpit . 
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Touchdown  occurred  at  1310  and  the  Captain  brought  the  plane  to  a  stop  in 
5,300  feet  with  the  ARFF  crews  following.  Escape  chutes  were  deployed  and 
everyone  exited  within  two  minutes.  There  were  30  minor  injuries  during  the 
evacuation,  and  10  people  complained  of  discomfort  from  the  smoke.  Fire¬ 
fighters  removed  panelling  and  completely  extinguished  the  fire. 

SCENARIO  10  -  FIRE  NARRATIVE.  At  approximately  1145,  lint  and  loose 
debris  in  the  cheek  area,  next  to  the  galley  oven,  were  ignited  by  an 
intermittent  electrical  arc.  The  arc  was  the  result  of  mechanical  damage 
sustained  by  power  cables.  As  the  fire  developed,  the  smoke  it  produced  rose 
vertically  and  was  distributed  overhead,  fore  and  aft  within  the  cheek  area. 
Five  minutes  later,  a  small  leak  developed  in  an  aluminum  hydraulic  line  as  a 
result  of  contact  with  the  flame.  Fluid  leaking  from  the  hydraulic  line  ignited 
and,  at  approximately  1155,  burned  through  into  the  galley  area.  At  1200, 
power  was  shutdown  to  the  involved  hydraulic  system  and  the  fuel  flow  from 
the  leak  quickly  diminished  to  zero.  By  1204  the  galley  was  completely  filled 
with  smoke,  restricting  visibility.  By  1210  the  fire  had  diminished  because  the 
available  fuel  was  being  depleted,  however,  the  cheek  area  remained  filled  with 
smoke.  Smoke  continued  to  flow  through  the  hole  in  the  wall  into  the  galley 
area.  At  1225  smoke  was  visible  in  the  passenger  cabin.  By  1228  the  galley 
was  totally  obscured.  The  fire  in  the  cheek  area  continued  to  diminish  as  the 
limited  fuel  was  consumed  and  burned  out,  at  approximately  1240.  Smoke 
continued  to  move  through  the  galley  and  up  the  elevator  shaft  into  the 
passenger  compartment  area.  At  1251  the  smoke  became  thicker  in  the 
passenger  cabin.  Smoke  did  not  enter  into  the  cockpit  and  the  aircraft  touched 
down  at  1310.  The  smoke-temperature  signatures  are  shown  in  Figure  14. 

SCENARIO  10  -  PROBLEM  ANALYSIS. 

Background .  This  incident  involved  a  fire  ignited  by  overheated  electrical 
wires  in  the  space  between  the  interior  galley  (lower  lobe)  wall  and  the  fuselage 
in  the  cheek  of  a  wide  body  tri-jet.  Smoke  was  detected  at  about  2  hours  into 
the  flight  issuing  from  the  galley.  The  source  was  presumed  to  be  in  the 
galley,  and  an  extinguisher  was  discharged  toward  the  oven  closest  to  the 
smoke  flow.  An  emergency  landing  was  made  at  a  military  airfield  and  the 
passengers  exited  by  the  emergency  slides  following  a  maximum  effort  stop. 

Detection  of  the  Fire.  In  this  incident,  the  smoke  was  initially  detected 
by  a  sensor  located  in  the  affected  galley  with  an  alarm  in  the  cockpit. 
Later,  smoke  was  seen  in  the  galley  and  the  lift  as  well  as  in  the  cabin.  No 
active  fire  was  ever  detected  in  flight. 

Localization  of  the  Fire.  Because  the  galley  alarm  activated  and  because 
the  smoke  was  visible  in  the  galley  and  lift,  it  was  assumed  that  the  source  was 
in  the  galley.  On  the  second  trip  to  the  galley,  the  Flight  Engineer  was  unable 
to  see  through  the  smoke  in  the  galley  and  could  not  confirm  the  exact  location. 

Identification  of  Fire  Severity.  The  Flight  Engineer  on  his  first  trip  to 
the  area  discharged  an  extinguisher  into  the  galley  adjacent  to  and  at  the 
ovens.  He  then  reported  that  the  fire  was,  "under  control".  On  his  second 
trip  to  the  oven,  he  was  unable  to  see  through  the  smoke  in  the  galley  and 
correctly  decided  that  there  was  a  persistent,  strong  source  of  smoke.  He 
advised  the  Captain  to  make  an  emergency  landing  as  soon  as  possible. 


94 


(do)  3aniva3dW3i 


95 


FIGURE  14.  SCENARIO  10:  SMOKE-TEMPERATURE  SIGNATURES 


Evaluation  of  Situation  and  Selection  of  Action.  The  Flight  Engineer,  when 
confronted  with  impenetrable  smoke  correctly  assessed  the  situation  and  advised 
the  only  feasible  action  which  the  Captain  implemented:  immediate  diversion  and 
emergency  landing.  Subsequently,  the  Captain  elected  to  use  the  closest 
adequate  airfield  even  though  it  is  a  military  field  and  then  to  make  a  maximum 
effort  stop  and  evacuate  the  passengers  by  slides.  All  of  these  were 
appropriate  and  were  successfully  implemented. 

Conclusion.  Overall,  this  incident  was  properly  handled  within  the 
existing  system  structure.  Rapid,  positive  detection  of  the  source  could  have 
allowed  the  crew  to  penetrate  the  galley  wall  and  apply  an  extinguisher  more 
directly  (provided  that  tools  were  available  and  the  procedure  was  allowed). 
More  remotely  possible  would  have  been  the  identification  of  the  involved  wiring 
so  that  breakers  could  have  been  pulled. 

SCENARIO  10  -  ACES  ANALYSIS.  In  this  scenario,  fire  in  a  cheek  area 
adjacent  to  a  lower  lobe  galley  ignited  and  developed  unknown  to  passengers  or 
crew.  The  fire  led  to  a  leak  in  a  hydraulic  line  which  added  fuel;  this 
increased  fire  penetrated  the  galley  wall  and  filled  the  galley  area  with  smoke, 
triggering  an  alarm  at  1156. 

The  smoke  in  the  lower  lobe  galley  increased  almost  instantaneously  to  total 
obscuration.  The  ACES  with  a  sensor  unit  in  the  galley  sj^stem  would  have 
sensed  smoke  at  about  the  same  time  as  the  current  system  did.  In  addition, 
the  ACES  system  would  have  almost  immediately  determined  a  rapidly  growing, 
positive  rate  of  rise.  This  would  have  first  set  a  smoke  alert  and  then  a  smoke 
alarm  because  of  the  persistent  rate  of  rise.  Meanwhile,  after  about  3  to  5 
minutes,  the  ACES  heat  detector  would  have  sensed  heat  above  ambient  with  a 
rapid  rise  rate  and  a  positive  fire  alarm  would  have  been  established  at  about 
1200  or  1201*.  Thus,  the  ACES  system  (using  only  the  galley  mounted 
sensors)  would  have  informed  the  crew  of  a  positive  fire  and  forced  display  of 
appropriate  emergency  procedures  by  no  later  than  1201.  Assuming  a 
reasonable  time  for  reaction  and  for  requesting  and  receiving  an  emergency 
clearance,  this  flight  could  havp  been  en  route  to  an  emergency  diversion  field 
by  no  later  than  1205.  This  did  not  occur  in  the  scenario  until  1234.  Thus, 
the  ACES  benefit  in  this  situation  would  have  been  a  much  earlier  decision  to 
declare  an  emergency  with  the  possibility  of  diverting  to  a  closer  suitable  field. 
Further,  the  information  that  the  incident  was  a  true  fire  might  have  influenced 
the  way  in  which  the  extinguisher  attack  was  mounted.  A  landing  could  have 
been  made  as  early  as  1205  with  this  ACES  configuration. 

The  above  discussion  is  based  only  on  sensing  in  the  galley.  A  more 
complete  and  more  sophisticated  ACES  could  have  included  cheek  sensors  in  the 
affected  area.  Both  heat  and  smoke  sensing  in  that  area  combined  with 
monitoring  of  the  electrical  system  would  have  sensed  the  arcing  that  ignited 
the  fire  as  well  as  the  resulting  combustion.  The  fire  narrative  shows  that  this 
could  have  occurred  as  early  as  1145  and  certainly  by  1150.  The  positive  alarm 
of  fire  at  that  time  would  have  dramatically  increased  the  time  available  for 
diversion  and  other  appropriate 


♦The  heat  signature  in  the  galley  would  parallel  the  "hydraulic  line"  heat 
curve  shown  in  Figure  14.  The  rate  of  rise  in  the  galley  would  be  positive  but 
somewhat  more  shallow. 
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emergency  procedures.  Since  the  fire  was  in  a  cheek  area,  this  very  early 
detection  could  not  have  been  exploited  in  an  attack  on  the  fire  under  current 
procedures.  If  fire  ports  or  the  use  of  forcible  access  should  be  adopted, 
early  detection  would  permit  a  direct  and  more  successful  attack.  This  ACES 
configuration  would  have  permitted  landing  at  a  diversion  field  as  early  as  1150. 
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TABLE  10.  SCENARIO  10  -  TIMELINE  SUMMARY 


TABLE  10.  SCENARIO  10  -  TIMELINE  SUMMARY  (Continued) 
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FLIGHT  PHASE 


SCENARIO  11  -  GALLEY  FIRE. 

SCENARIO  11  -  DESCRIPTION.  A  narrow  body  twin-jet  was  operating  nonstop 
from  Miami  International  to  Newark  International  with  a  2205  departure  time.  A 
total  of  80  passengers  and  a  crew  of  7  (Captain,  First  Officer  and  5  Cabin 
Attendants)  were  on  board.  The  flight  left  the  gate  on  time  and  took  off  at 
2219. 

After  reaching  the  assigned  altitude,  at  2239,  a  snack  was  served.  At  2301  the 
Utter  had  been  cleared  and  the  main  cabin  Ughts  were  extinguished  to  allow  the 
passengers  to  sleep.  Two  wrapped  snack  dishes  were  inadvertently  left  in  one 
of  the  warming  ovens  in  the  aft  galley.  After  about  10  additional  minutes  of 
heating,  they  began  to  smolder.  By  2315  smoke  was  being  emitted  from  the 
oven  into  the  galley.  At  this  point,  the  aircraft  was  approximately  45  miles 
east  of  Charleston,  South  Carolina  at  flight  level  310. 

The  smoke  initially  went  unnoticed  by  both  the  crew  and  the  passengers.  At 
2322  a  passenger  walking  down  the  aisle  to  the  lavatories  saw  smoke  coming 
from  the  galley  and  alerted  a  FUght  Attendant.  She  in  turn  told  another 
Attendant  to  notify  the  cockpit  while  she  went  to  retrieve  a  hand  fire 
extinguisher.  At  2324  the  First  Officer  was  notified  of  smoke  in  the  galley. 

He  told  the  Captain  who  ordered  the  aft  galley  breakers  to  be  pulled.  The 
First  Officer  then  scanned  the  panel  and  pulled  the  breakers  at  2326. 

The  smoke  was  so  thick  in  the  galley  that  the  Flight  Attendant  with  the  hand 
extinguisher  could  not  see  to  discharge  the  extinguisher  at  the  base  of  the 
fire.  At  2328  she  called  the  cockpit  and  notified  the  First  Officer  that  smoke 
was  apparently  still  being  generated.  The  Captain  then  notified  ATC  of  a 
possible  emergency  and  requested  immediate  clearance  to  a  lower  altitude.  He 
was  cleared  to  flight  level  180  and  began  a  descent.  At  the  same  time,  he 
instructed  the  First  Officer  to  don  his  smoke  mask  and  portable  oxygen  bottle, 
and  take  another  extinguisher  and  go  back  to  take  control  of  the  situation. 
The  First  Officer  exited  the  cockpit  at  2341  and  arrived  at  the  galley  at  2342. 
With  the  aid  of  his  smoke  equipment  he  could  see  that  the  smoke  was  coming 
from  the  oven.  He  opened  the  door  and  discharged  his  fire  extinguisher  at  the 
food  trays  inside.  He  then  used  one  of  the  serving  utensils  to  extract  the  food 
trays  and  examine  them.  Convinced  that  they  were  the  only  source  of  the 
smoke,  he  exited  the  galley  and  went  to  the  intercom  to  report  to  the  Captain. 

The  Captain  meanwhile'  retrieved  the  FCOM  and  found  the  procedures  for  smoke 
removal.  He  set  the  landing  altitude  selector  to  9,500  ft  and  placed  the  auto 
pressure  control  of  the  air  conditioning  system  on  maximum.  He  also  turned  off 
the  left  and  right  recirculation  fan  switches  and  illuminated  the  "No  Smoking" 
and  "Fasten  Seatbelts"  signs.  Finding  the  FCOM  checklist  and  executing  the 
steps  took  until  2345.  The  Captain  then  made  a  preliminary  announcement  to 
calm  the  passengers  and  turned  to  the  task  of  finding  a  suitable  landing  site. 

The  navigation  display  of  the  Flight  Management  System  showed  Wilmington, 
N.C.  as  the  closest  airport.  Since  his  company  had  operations  into  Wilmington, 
the  Captain  called  ATC  and  requested  clearance  direct  to  Wilmington.  He 
declared  an  emergency  and  requested  ARFF  equipment.  At  2349  ATC  granted 
clearance  to  Wilmington  and  to  descend  to  2,000  feet.  The  Captain  began 
programming  the  Flight  Management  System  for  the  approach.  At  2351  the 
Captain  informed  him  to  notify  the  Attendants  to  move  all  passengers  as  far 
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forward  as  possible,  directed  him  to  return  to  the  cockpit  and  prepare  for  an 
immediate  approach  to  Wilmington. 

The  Captain  then  called  ATC  and  explained  that  the  fire  was  out,  but  there 
was  still  considerable  smoke  in  the  cabin.  He  cancelled  the  request  for 
equipment,  but  asked  for  EMTs  to  treat  any  possible  problems  of  smoke 
inhalation . 

At  0005  the  plane  touched  down  at  Wilmington.  After  roll  out,  the  captain 
ordered  the  forward  and  aft  left  passenger  doors  opened  for  ventilation  and 
taxied  to  the  terminal.  Several  passengers  complained  of  burning  eyes  and 
were  examined  by  the  EMTs  and  released.  The  plane  was  thoroughly  inspected 
and  allowed  to  ventilate  and  then  returned  to  service. 

SCENARIO  11  -  FIRE  NARRATIVE.  In  this  incident  food  left  inadvertently  in 
the  aft  galley  warming  oven  Continued  to  be  heated  and  consequently  generated 
smoke  at  approximately  2310.  The  smoke  was  initially  contained  within  the 
oven.  However,  at  2315  the  smoke  emitted  from  the  oven  into  the  galley.  The 
smoke  continued  to  build  up  in  the  aft  galley  area  but  was  not  noticed  until 
2322.  Even  after  the  aft  galley  circuit  breakers  had  been  pulled,  the  food 
continued  to  smolder  for  more  than  ten  minutes.  The  food  trays  never  reached 
the  flaming  stage  and  the  smoldering  material  was  contained  within  the  oven. 
The  smoldering  food  was  extinguished  by  use  of  a  fire  extinguisher.  The 
smoke  signature  in  the  galley  is  shown  in  Figure  15. 

SCENARIO  11  -  PROBLEM  ANALYSIS. 

Background.  This  incident  involved  food  dishes  being  left  in  a  warming 
oven  and  the  oven  left  on.  Both  of  these  events  were  by  mistake.  The  food 
began  to  smolder  and  generate  smoke.  This  smoldering  fire  was  extinguished 
and  emergency  ventilation  was  implemented.  The  flight  diverted  to  the  closest 
alternate  field  and  a  normal  landing  was  made. 

Detection  of  the  Fire.  Initial  detection  was  by  a  passenger  who  saw  smoke 
issuing  from  the  galley.  There  was  no  detector  in  this  area  so  the  detection 
and  subsequent  evaluations  were  visual.  Heat  and/or  smoke  smoke  detectors 
might  have  sensed  the  incident  earlier  resulting  perhaps  in  less  smoke  in  the 
cabin . 

Localization  of  the  Fire.  The  site  of  this  incident  was  established  when 
detection  was  made  in  the  galley  area.  The  exact  site  (in  the  galley  oven)  was 
determined  when  the  First  Officer  used  an  extinguisher. 

Identification  of  Fire  Severity.  The  First  Officer  correctly  assessed  the 
severity  when  he'  examined  the  galley  and  applied  the  extinguisher  to  the  oven 
and  its  contents.  He  advised  the  further  response  of  diverting  to  the  nearest 
adequate  airfield,  which  the  Captain  implemented. 

Evaluation  of  Situation  and  Selection  of  Action.  The  First  officer  went  to 
the  galley  area  with  protective  equipment  ready  to  attack  the  fire.  When  the 
First  Officer  arrived  at  the  galley  he  confirmed  the  evaluation  that  it  was  a 
controllable  fire  and  extinguished  it. 
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FIGURE  15.  SCENARIO  11:  GALLEY  SMOKE  SIGNATURE 


Conclusions .  This  incident  was  properly  handled:  the  smoke/ fire 
situation  was  correctly  assessed  and  successful  extinguishment  was  carried  out. 
Because  the  initial  detection  was  of  smoke  issuing  from  the  galley,  the 
possibility  existed  that  the  source  was  remote  from  the  galley  and  that  the  flow 
of  smoke  only  passed  through  the  galley.  Had  that  been  the  case,  evaluation 
and  response  would  have  been  performed  differently. 

SCENARIO  11  -  ACES  ANALYSIS.  In  this  scenario  heavy  smoke  is  generated 
by  food  trays  overheating  in  a  galley  oven  inadvertently  left  turned  on  after 
food  service  had  been  completed.  The  smoke  signature  developed  for  this 
incident  indicates  that  the  ACES  system  would  have  sensed  smoke  as  early  as 
about  2305,  the  ACES  would  have  almost  immediately  determined  a  growing, 
positive  rate  of  rise  and  established  an  alert  condition.  By  no  later  than  2310 
the  ACES  would  have  established  a  smoke  alarm  because  of  the  persistent  rate 
of  rise.  The  ACES  system  would  have  reset  the  redline  on  the  related  heat 
sensor;  but  no  significant  heat  rise  above  ambient  occurred  except  very  closely 
adjacent  to  the  oven.  Assuming  that  the  ACES  was  configured  with  the  sensor 
pair  co-located  to  sense  the  whole  galley  area,  the  smoke  alert  and  warning 
would  have  been  as  described  just  above.  If,  as  might  be  done,  the  oven  had 
been  equipped  with  ACES  heat  sensing  the  system  would  have  been  able  to 
provide  more  precise  location  of  the  incident  and  perhaps  have  detected  the  fact 
that  the  oven  had  been  on  longer  than  was  appropriate.  That  heat  sensor  data 
would  have  been  useful,  but  even  if  only  the  overall  galley  sensing  had  been  in 
place,  the  ACES  would  have  warned  the  crew  about  12  to  17  minutes  before  the 
smoke  was  actually  seen.  Allowing  about  2  to  3  minutes  for  the  oven  to  be 
shut  down,  the  generation  of  smoke  could  have  been  stopped  at  no  later  than 
2312,  when  the  smoke  was  just  becoming  visible.  Smoke  removal  and  any 
subsequent  emergency  actions  could  have  proceeded  more  easily  in  the  lesser 
amount  of  smoke. 
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TABLE  11.  SCENARIO  11  -  TIMELINE  SUMMARY 
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FLIGHT  PHASE  Cruise  Cruise  Cruise  Cruise  Cruise 


SCENARIO  12  -  HAZARDOUS  CARGO  FIRE. 

SCENARIO  12  -  DESCRIPTION.  A  narrow  body  four-engine  jet  aircraft  in  a 
cargo-only  configuration  was  on  a  scheduled  cargo  flight  from  John  F.  Kennedy 
International  Airport  (JFK),  New  York,  to  Frankfurt,  Germany  with  a  scheduled 
stop  at  Prestwick,  Scotland.  The  flight  departed  JFK  at  0825  Eastern  time. 
Among  its  cargo,  was  a  box  containing  a  bottle  of  nitric  acid  packed  in  a 
wooden  crate  with  sawdust  as  cushioning  material.  This  crate  was  loaded  in  the 
forward  portion  of  the  main  cargo  compartment.  The  nature  of  the  contents  of 
the  box  was  not  declared  at  check-in,  and  the  acid  was  not  packaged  in 
accordance  with  FAA  rules. 

At  about  0830,  unknown  to  the  three-man  flight  crew,  the  nitric  acid  spilled 
into  the  sawdust  and  began  the  process  of  hypergolic  (self-sustaining) 
combustion.  At  0904  with  the  aircraft  approximately  100  miles  east  of  Montreal, 
smoke  from  the  fire  had  spread  to  the  cockpit  by  way  of  the  return  air  grille 
and  was  detected  by  the  crew. 

Upon  detection  of  the  smoke,  the  crew  concluded,  erroneously,  that  they  were 
dealing  with  a  minor,  below-deck  electrical  fire.  They  continued  to  believe  this 
conclusion  even  though  no  circuit  breakers  had  popped.  They  contacted  their 
company's  New  York  operations  department  (OPS)  at  JFK  and  asked  whether 
they  should  return  or  divert  to  Logan  International  at  Boston.  Because  they 
had  underestimated  their  problem,  they  did  not  plan  to  divert  to  the  nearest 
suitable  field  but,  to  use  an  airport  at  which  their  company  had  maintenance 
and  repair  facilities. 

At  0906  the  flight  was  told  by  OPS  to  return  to  JFK.  At  the  same  time,  they 
were  handed  off  by  the  Boston  Center  to  the  Montreal  Center.  In  the 
confusion,  the  crew  did  not  hear  the  frequency  specified  by  the  Boston  Center 
for  the  hand  off  and  took  until  0909  to  establish  contact  with  Montreal  Center. 
They  were  given  clearance  to  return  to  JFK  direct  at  0910.  The  smoke  in  the 
cockpit  was  increasing.  The  smoke  detectors  in  the  avionics  bay  activated. 

Also  at  0910  the  crew  decided  to  go  on  oxygen.  Shortly  thereafter  at  0911,  the 
Captain  realized  that  reaching  JFK  safely  would  be  a  problem.  He  therefore 
radioed  OPS  and  informed  them  that  he  was  diverting  to  Logan.  He  then  called 
Boston  Center  and  requested  both  direct  Boston  and  an  immediate  descent-  to 
increase  his  fuel  burn.  A  heading  for  Boston  was  given  and  clearance  to 
descend  from  flight  level  310  to  level  180  was  granted  at  0912. 

The  Captain  requested  AFRR  coverage  at  Logan  through  his  OPS  department, 
but  he  never  declared  an  emergency.  At  0914  the  Captain  asked  the  First 
Officer  if  he  had  Boston  approach  plates  but  received  no  response.  Also  at 
0914  the  Flight  Engineer  confirmed  that  the  fire  warning  circuit  and  alarm  were 
functioning.  The  Captain  gave  the  airplane  to  the  First  Officer  and  began 
searching  for  his  own  Boston  approach  plates. 

For  the  next  10  minutes,  the  crew  attempted  to  prepare  for  a  normal  landing  at 
Logan  in  spite  of  the  thick  smoke.  They  received  the  field  altimeter  setting 
and  requested  a  landing  on  runway  33.  They  called  their  company's  operations 
center  at  Logan  at  0924  to  advise  of  an  "electrical  fire  in  the  forward  end  of 
the  airplane."  At  0927  they  had  descended  to  2,000  feet  and  slowed  sufficiently 
to  put  the  gear  down  and  open  the  cockpit  window  to  try  to  remove  some  of  the 
smoke.  The  open  window  actually  served  to  draw  more  smoke  into  the  cockpit. 
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By  0932  they  were  35  miles  northeast  of  Logan  at  2,300  feet  and  notified  the 
tower  that  they  were  not  declaring  an  emergency.  At  0935  the  Captain  refused 
a  vector  to  a  5  mile  final,  requested  a  "quick  in"  and  was  cleared  to  the  Boston 
VOR.  Immediately  thereafter,  the  fire  burned  through  electrical  cables  and  cut 
off  radio  transmission.  The  aircraft  crashed  short  of  the  runway  at  0940  after 
a  series  of  yawing  and  rolling  maneuvers.  These  were  attributed  to  the  fact 
that  the  yaw  damper  has  been  rendered  inoperative  in  the  normal  load  shedding 
prescribed  in  the  Flight  Crew  Operations  Manual  which  the  Flight  Engineer  had 
implemented  at  0935 . .  The  Captain  was  unaware  that  the  Flight  Engineer  had 
executed  the  smoke  countermeasure  procedures.  All  aboard  perished. 

SCENARIO  12  -  FIRE  NARRATIVE.  While  climbing  out  after  takeoff,  the 
aircraft  passed  through  an  area  of  moderate-to-severe  turbulence.  At  that 
time,  an  improperly  packed  container  of  fuming  nitric  acid  spilled  into  a  bed  of 
sawdust,  used  as  packing  material,  inside  a  wooden  crate  (Figure  16A).  Due  to 
the  strong  oxidizing  capability  of  the  nitric  acid,  combined  with  the  small 
particle  sizes  of  the  sawdust,  rapid  oxidation  took  place,  quickly  resulting  in 
flaming  combustion.  Temperatures  inside  the  crate  rose  rapidly  and  quickly 
exceeded  1,000°F  as  the  fire  broke  out  of  the  crate  and  began  to  grow  rapidly. 
Since  the  main  deck  was  nearly  filled  with  cargo,  the  small  volume  of  the  the 
hazardous  cargo  area,  adjacent  to  the  flight  deck  bulkhead,  rapidly  filled  with 
smoke.  It  began  to  migrate  forward  to  the  cheek  area  adjacent  to  the  cockpit 
and  below  the  main  cargo  deck,  to  the  vicinity  of  the  below-deck  avionics  bay 
identified  as  Lower  41  (Figure  16B).  At  approximately  0840,  the  fire  was 
spreading  slowly  through  other  cargo  on  the  main  deck.  Immediately  after  the 
fire  ignited,  temperatures  in  the  hazardous  cargo  area  rose  rapidly  and 
reached,  perhaps,  800°F  at  the  ceiling  and  tapered  off  as  the  box  began  to  be 
consumed.  As  the  fire  developed  slowly  through  the  tightly  packed  cargo,  the 
temperature  in  the  main  cargo  area  rose  and,  at  0850,  reached  about  6 00°F. 

By  0904,  smoke  began  to  leak  into  the  cockpit  via  the  return  air  grille  (Figure 
16C).  As  the  smoke  level  increased  in  the  cockpit,  levels  in  Lower  41  also  rose 
and  at  0910  the  smoke  detector  in  that  bay  activated.  By  0914  the  main  cargo 
deck  was  completely  obscured  in  the  hazardous  cargo  area. 

Smoke  continued  to  get  thicker  on  the  flight  deck  and  vision  was  sufficiently 
obscured  that  small  instruments  could  not  be  read  on  the  panel  (Figure  16D). 
At  0935  either  hot  gases  or  flames  from  the  fire  on  the  main  cargo  deck  caused 
electrical  failures  resulting  in  loss  of  communication.  The  aircraft  crashed  at 
0940.  The  smoke-temperature  signatures  are  shown  in  Figure  17. 

SCENARIO  12  -  PROBLEM  ANALYSIS. 

Background.  This  incident  had  its  origin  in  a  container  of  hazardous 
material — mtnc  acid  which  is  a  hypergol:  it  initiates  combustion  on  contact  with 
combustible  material  and  supports  combustion  as  it  continues  to  oxidize.  This 
material  had  not  been  properly  packaged  for  shipment  and  it  had  not  been 
identified  in  the  manifest.  At  about  one-half  hour  into  a  trans-atlantic  cargo 
flight  the  acid  spilled  igniting  adjacent  material.  The  fire  was  never  correctly 
identified,  in  part  because  the  crew  did  not  know  the  acid  was  on  board. 
Following  the  appearance  of  smoke  in  the  cockpit,  there  was  a  series  of 
inappropriate  decisions  and  responses.  The  outcome  was  a  crash — while  on  a 
final  approach — and  fire  which  killed  all  three  crew  members  and  destroyed  the 
aircraft . 
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FIGURE  16A.  FUMING  NITRIC  ACID  IN 
WOODEN  CRATE 


FIGURE  16B.  FIRE  GREW  RAPIDLY— SMOKE 
FILLED  MAIN  CARGO  DECK 
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FIGURE  16C.  SMOKE  LEAKED  INTO 

COCKPIT  FROM  LOWER  41 
VIA  RETURN  AIR  GRILLE 
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FIGURE  16D.  SMOKE  OBSCURED  SMALL 
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COCKPIT 
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FIGURE  17.  SCENARIO  12:  SMOKE-TEMPERATURE  SIGNATURES 


Detection  of  the  Fire.  Initial  detection  of  this  incident  was  visual:  smoke 
was  seen  issuing  from  the  floor  of  the  cockpit.  Smoke  was  moving  through  the 
return  air  grilles  which  connected  the  cockpit  to  the  avionics  bay. 

Localization  of  the  Fire.  The  appearance  of  smoke  issuing  from  the  return 
air  grilles  in  the  cockpit  led  to  the  conclusion  that  the  source  was  either 
electrical  overheating  or  fire  in  the  electrical  compartment.  This  conclusion  was 
not  changed  during  the  course  of  this  incident  ending  in  the  crash  and  fire. 
There  were  no  positive,  corroborative  indications  (such  as  popped  circuit 
breakers  or  failed  equipment)  to  sustain  the  conclusion  that  the  source  was 
electrical.  Subsequent  investigation  suggested  that  the  fire  began  in  the  main 
cargo  compartment  at  close  to  floor  level  on  the  left  side  of  the  aircraft.  From 
there,  smoke  moved  through  the  return  air  system  into  the  Lower  41  area  and 
from  there,  through  the  grilles  into  the  cockpit. 

Much  later  in  the  incident  some  attempt  was  made  to  examine  the  main  cargo 
area  and  the  Lower  41;  by  then  heavy  smoke  was  present  in  the  main  area  and 
a  lesser  amount  in  the  Lower  41.  The  crew  theorized,  wrongly,  that  an 
electrical  fire  in  Lower  41  was  generating  smoke  which  passed  through  the 
cockpit  (and  by  other  routes)  into  the  main  cargo  area  where  it  accumulated. 
The  reverse  progression  was,  of  course,  the  correct  one. 

Identification  of  Fire  Severity.  Since  there  was  no  investigation  by  the 
crew,  the  severity  of  the  fire  was  never  explicitly  assessed.  The  persistent 
and  growing  smoke  density  was  noted  and  late  in  the  incident  it  was  also  noted 
that  there  was  no  other  evidence  of  an  electrical  fire.  Yet,  it  was  never 
concluded  that  a  severe  fire  existed  in  a  location  other  than  the  electrical  bay. 
The  apparent  conclusion  (never  actually  stated)  was  that  an  electrical  overheat 
or  fire  was  inherently  not  extremely  dangerous  and  that  circuit  breakers  and 
load  shedding  would  overcome  the  problem. 

Evaluation  of  the  Situation  and  Selection  of  Action.  The  source  and  the 
severity  of  the  fire  were  never  identified  correctly,  so  no  accurate  evaluation 
could  have  been  made.  Because  the  crew  persisted  in  the  erroneous  conclusion 
that  it  was  an  electrical  overheat  or  fire,  the  only  potentially  effective 
action — immediate  diversion  to  the  nearest  suitable  field — was  never  taken.  The 
Captain  first — with  the  advice  of  his  operations  department — elected  to  return  to 
his  departure  point,  JFK.  This  entailed  45  minutes  flight  time.  When  it 
became  apparent  that  the  flight  could  not  reach  JFK,  the  Captain  requested 
clearance  to  Boston's  Logan  Airport.  The  Captain,  still  under  the 
misperception  that  the  fire  was  electrical  (and  presumably  not  especially 
hazardous)  passed  a  military  airfield  that  was  suitable  and  much  closer  than 
Logan.  Further,  an  emergency  was  never  declared  although  at  this  stage  of 
the  flight  such  a  declaration  would  have  had  little  effect.  During  the  diversion 
to  Logan,  there  was  some  confusion  in  the  cockpit  as  to  radio  frequencies  and 
there  was  some  delay  in  locating  the  proper  approach  plates.  These  latter 
problems  may  have  been  simply  poor  crew  procedure,  or  the  result  of  rapidly 
increasing  stress,  or  the  result  of  some  physical  effects  of  the  smoke-laden 
environment.  These  causes  may  also  have  worked  in  some  interrelated  way  to 
produce  less  than  appropriate  responses.  Another  difficulty  arising  from  crew 
performance  occurred  when  the  flight  was  on  approach  to  Logan  and  the  Flight 
Engineer  executed  equipment  shutdown  to  unload  the  electrical  system  to  only 
minimum  required  equipment.  This  shutdown  removed  yaw  damping,  but  the 
Captain  was  unaware  that  the  shutdown  had  been  made.  Just  prior  to  the 
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crash,  the  aircraft  was  observed  to  go  through  extreme  and  erratic  yawing 
probably  because  there  was  no  damping.  At  about  35  miles  from  touchdown, 
the  crew  attempted  to  ventilate  the  smoke  by  opening  a  cockpit  window . 
Because  the  location  and  source  of  this  fire  had  been  wrongly  identified,  this 
action  only  resulted  in  bringing  more  smoke  into  the  cockpit  and  perhaps 
increased  the  rate  of  burning. 

Conclusions .  In  this  incident  there  are  two  crew-related  events  which 
were  major  contributors:  the  crew  never  attempted  to  establish  the  exact 
location  and  nature  of  the  fire  even  though  the  initial  evaluation  of  electrical 
overheat  was  never  confirmed.  The  second  contributor  consisted  of 
inappropriate  decisions  and  responses.  Some  of  these  stemmed  from  the  wrong 
identification  and  some  appeared  to  be  the  result  of  less  than  standard  crew 
performance.  Specifically,  when  there  was  no  confirmation  of  an  electrical  fire 
(loss  of  equipment  function  or  circuit  breakers  popping)  the  crew  should  have 
initiated  a  more  intensive  analysis  of  the  incident.  Also,  the  Captain 
apparently  concentrated  too  much  on  bringing  the  aircraft  to  a  field  at  which 
his  company  had  facilities.  In  view  of  the  fact  that  the  fire  was  never  firmly 
established  as  electrical  or  as  being  in  the  Lower  41,  the  Captain  should  have 
given  much  greater  emphasis  simply  to  getting  the  aircraft  on  the  ground. 

It  can  be  inferred  that  crew  procedures  and  coordination  were  generally  poor. 
The  really  critical  problems  occurred,  however,  only  when  the  fire  and  smoke 
were  well  advanced  and  the  resulting  stress  on  the  crew  was  extreme. 

SCENARIO  12  -  ACES  ANALYSIS.  The  incident  in  this  scenario  began  when  an 
improperly  packed  container  of  nitric  acid  was  placed  aboard  an  all-cargo  flight 
and  not  identified  on  the  manifest.  The  acid  spilled  at  0830,  triggering  a 
hypergolic  combustion.  There  were  no  sensors  in  the  cargo  compartment; 
smoke  appeared  at  0904  in  the  cockpit  (by  way  of  the  "return  air"  grille)  and 
smoke  sensors  in  the  avionics  bay  below  the  cockpit  activated  at  0910. 

The  ACES  system  in  this  situation  would  have  provided  a  positive  alarm  of  fire 
just  a  few  minutes  after  ignition  at  0830.  The  dual  sensor  logic  would  have 
sensed  smoke  and  determined  a  rapid  rate  of  rise  by  about  0834.  The  redline 
for  heat  would  have  been  reset  at  that  time  and  a  smoke  alert  established. 
Heat  would  have  been  detected  about  two  minutes  later  so  that  a  positive  fire 
alarm  would  have  been  established  showing  intense  burning  at  about  0836. 
Since  the  actual  event  was  first  detected  at  0904,  the  ACES  system  would  have 
provided  an  additional  28  minutes  in  which  the  crew  could  react  and  take 
appropriate  action. 

More  significantly  the  ACES  system  could  have  provided  a  positive  alarm  of  an 
intense  fire,  and  given  an  exact  location.  Throughout  the  incident  as  it 
occurred,  the  crew  persisted  in  the  conclusion  that  it  was  heavy  smoke  being 
producted  in  the  avionics  bay  because  smoke  appeared  to  be  coming  from  that 
area.  They  persisted  also  in  the  belief  that  the  source  of  smoke  was  not  an 
active,  intense  fire;  but  rather  an  electrical  overheat  that  could  build  to  an 
active  fire.  This  belief  was  maintained  in  spite  of  the  fact  that  there  was  no 
direct  evidence  from  any  electrical  component.  This  erroneous  interpretation 
was  continued  even  after  smoke  had  been  seen  in  the  cargo  compartment — the 
conclusion  being  that  it  was  spreading  through  the  return  air  system  to  the 
cabin.  (Actually,  of  course,  the  exact  reverse  of  what  was  happening.) 
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The  real  benefit  of  the  ACES  then  would  have  been  an  exact  and  reliable 
location  of  the  event  and  a  reliable  determination  of  its  severity.  The  fact  that 
ACES  would  have  given  almost  a  half-hour  earlier  warning  is  almost  incidental 
in  this  scenario.  The  crew's  actions  based  on  wrong — but  somewhat 
credible — diagnoses  could  have  been  successfully  corrected  even  if  the  ACES 
information  had  not  been  received  until  0904 — the  time  at  which  smoke  was 
actually  seen.  At  that  time  there  were  closer,  suitable  airfield  alternates  both 
civilian  and  military;  but  using  the  wrong  diagnosis,  the  crew  elected  to 
attempt  to  return  to  JFK. 

In  the  fire  narrative,  the  evidences  of  combustion  in  the  avionics  bay  as  well  as 
the  cockpit  are  described.  The  ACES  system  would  have  sensed  and  processed 
these,  but  that  would  probably  have  had  little  effect  on  the  outcome.  The  most 
important  aspect  of  ACES  for  this  situation  is  the  location  of  a  sensor  pair  in 
the  cargo  area  that  would  have  provided  reliable  location  and  severity 
information  in  a  timely  way. 
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SCENARIO  13  -  ACCIDENTAL  IGNITION  BY  PASSENGER. 

SCENARIO  13  -  DESCRIPTION.  A  wide  body  twin-jet  aircraft  was  operating 
nonstop  from  Los  Angeles  International  to  Boston's  Logan  International  as  the 
late  night  "redeye."  The  flight  crew  consisted  of  Captain  and  First  Officer;  in 
the  cabin  there  were  six  Attendants.  Departure  was  scheduled  for  2230  Pacific 
Time,  but  was  delayed  due  to  the  late  arrival  of  the  inbound  aircraft.  Take  off 
occurred  at  2335  after  normal  pre-flight  checklists.  The  crew  were  all 
experienced  in  type  and  had  flown  together  previously.  The  passenger  load 
was  light  with  only  80  passengers  on  board.  As  is  customary  on  late  night 
transcontinental  flights,  beverage  service  was  short  and  the  cabin  lights  were 
extinguished  at  0030.  Passengers  who  wanted  to  read  had  to  use  their 
individual  reading  lights. 

At  0045  a  passenger  in  the  left  side  window  seat  in  the  last  row  of  first  class 
decided  to  check  his  hotel  confirmation.  He  attempted  to  illuminate  his  reading 
light,  but  it  would  not  work.  With  his  attache  case  open  on  his  lap,  he  struck 
a  match  to  provide  sufficient  light  to  read.  The  entire  book  ignited,  and  he 
dropped  it  into  his  case  where  numerous  loose  papers  immediately  caught  fire. 
The  passenger  panicked  and  shoved  the  case  towards  the  vacant  seat  to  his 
right.  This  action  opened  a  can  of  lighter  fluid  in  the  attache  case  which 
leaked  out  and  quickly  spread  the  fire  to  the  seat  materials  and  the  clothing 
hung  on  the  hooks  attached  to  the  bulkhead.  At  this  time,  the  aircraft  was  120 
miles  east-northeast  of  Las  Vegas  at  flight  level  330. 

The  fire  effectively  blocked  the  aisle  at  a  time  when  all  of  the  Attendants  were 
in  the  aft,  coach  section  of  the  aircraft.  The  Senior  Flight  Attendant  heard 
the  commotion  and  looked  up  to  see  the  flames.  She  immediately  ordered  one  of 
the  other  Attendants  to  notify  the  cockpit  on  the  intercom.  She  then  located  a 
hand  fire  extinguisher  in  the  aft  compartment  and  went  forward  to  fight  the 
fire.  The  Captain  received  notification  on  the  intercom  at  0046. 

Upon  receiving  notice,  the  Captain  declared  an  emergency  to  ATC  and  donned 
his  oxygen  mask.  He  also  directed  the  First  Officer  to  take  the  hand 
extinguisher  from  the  cockpit,  don  his  smoke  mask  and  oxygen  bottle  and  take 
command  of  the  firefighting.  At  0048  the  First  Officer  exited  the  cockpit  into 
the  first  class  compartment  which  was  rapidly  filling  with  smoke. 

The  Captain  contacted  ATC  at  0050,  declared  an  emergency  and  requested 
immediate  clearance  to  McCarran  Field  in  Las  Vegas.  He  requested  AFRR  and 
emergency  medical  teams  to  meet  the  plane.  He  received  immediate  clearance  to 
descend  and  was  given  vectors  direct  to  McCarran. 

The  Captain  then  retrieved  the  Flight  Crew  Operations  Manual  (FCOM)  and 
looked  up  the  checklist  for  in-flight  fires.  He  took  the  necessary  actions. 

The  First  Officer  found  that  the  flames  had  been  almost  completely  extinguished 
by  the  first  fire  extinguisher  deployed  by  the  Senior  Flight  Attendant.  There 
appeared  to  be  some  continuing  smoldering  which  was  generating  smoke.  He 
discharged  his  extinguisher  at  the  smoking  area. 

The  passenger  who  had  started  the  fire  and  two  others  sitting  on  the  aisle  in 
the  first  row  of  coach  had  been  injured.  The  First  Officer  ordered  all 
passengers  from  first  class  and  the  first  10  rows  of  coach  to  move  aft  to  vacant 
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seats.  He  directed  the  Senior  Flight  Attendant  to  apply  first  aid  to  the 
injured.  He  then  returned  to  the  cockpit,  donned  his  oxygen  mask  and 
reported  to  the  Captain. 

At  0056  the  aircraft  was  in  a  rapid  descent  towards  Las  Vegas  when  the  Cabin 
Crew  reported  that  the  smoke  was  starting  to  cause  problems.  The  First 
Officer  reviewed  the  smoke  elimination  procedures  in  the  FCOM  and  told  the 
Captain  he  had  the  option  of  opening  the  left  forward  and  aft  doors  once  they 
were  below  10,000  feet,  provided  that  the  fire  was  completely  extinguished. 

At  0058  the  Cabin  Crew  reported  that  the  fire  was  completely  out,  but  that 
smoke  persisted  in  the  cabin  and  was  causing  breathing  and  eye  irritation 
problems  among  the  passengers.  The  Captain  directed  the  First  Officer  to  brief 
the  passengers  via  the  public  address  for  both  the  door  opening  and  an 
emergency  evacuation  after  landing.  At  0109  the  aircraft  had  descended 
through  10,000  feet,  and  the  Captain  slowed  the  rate  of  descent  to  2,000  ft/ min 
and  ordered  the  doors  opened.  This  helped  clear  the  smoke  and  prevent 
further  passenger  injuries  from  smoke  inhalation. 

ATC  gave  clearance  for  an  ILS  approach  to  McCarran  at  0105  and  notified  the 
crew  that  ARFF  and  EMTs  were  standing  by.  The  Captain  then  executed  a  safe 
landing  with  a  maximum  effort  stop  and  the  passengers  exited  by  the  evacuation 
slides.  AFRR  personnel  entered  the  aircraft  and  found  the  fire  had  been 
extinguished . 

SCENARIO  13  -  FIRE  NARRATIVE.  This  fire  was  caused  by  the  accidental 
ignition  of  a  book  of  matches,  which,  when  dropped  by  the  passenger,  ignited 
loose  papers  in  his  briefcase.  The  fire  escalated  further  when  it  contacted 
liquid  lighter  fluid  and  spread  quickly  to  seat  materials.  The  burning  materials 
generated  smoke  primarily  in  the  first  class  compartment.  The  fire  was  totally 
extinguished  within  five  minutes  by  use  of  hand-held  fire  extinguishers . 

SCENARIO  13  -  PROBLEM  ANALYSIS. 

Detection  of  the  Fire.  The  detection  of  this  incident  occurred  virtually 
simultaneously  with  the  start  of  the  fire.  The  Cabin  Crew  was  aware  of  the 
flames  as  soon  as  the  can  of  lighter  fluid  ignited. 

Localization  of  the  Fire.  Localization  also  occurred  simultaneously  with 
ignition.  There  could  be  no  question  as  to  its  location. 

Identification  of  Fire  Severity.  While  the  record  of  this  incident  shows  no 
explicit  assessment  of  severity,  the  immediate  declaration  of  emergency  and  the 
order  to  the  First  Officer  to  take  charge  of  attacking  the  fire,  suggest  that  the 
Captain  assessed  that  it  was  a  potentially  severe  fire.  This  was  apparently  a 
correct  assessment. 

Evaluation  of  the  Situation  and  Selection  of  Action.  The  situation  was 
correctly  evaluated  ai  having  a  potential  For  reaching  severe,  tragic 
proportions.  The  actions  which  began  with  declaring  an  emergency  and 
initiating  emergency  diversion  included  direct  attack  with  extinguishers  and 
movement  of  passengers  p. way  from  the  fire  site.  All  of  the  actions  were 
appropriate  and  correctly  implemented.  The  most  significant  event  in  this 
incident  was  the  Captain's  prompt  emergency  declaration  and  diversion. 
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Conclusions.  This  incident  while  an  unusual  and  perhaps  very  unlikely 
one,  was  evaluated  and  handled  in  a  prompt  and  efficient  manner  by  all  of  the 
crew.  By  initiating  an  emergency  diversion  immediately  upon  detection,  the 
Captain  maximized  the  probability  of  a  successful,  safe  landing.  He  also 
initiated  a  prompt  and  eventually  successful  attack  on  the  fire.  The  door 
opening  for  cabin  ventilation  proved  to  be  successful  and  the  emergency 
evacuation  was  completed  with  no  problems. 

SCENARIO  13  -  ACES  ANALYSIS.  This  scenario  involves  accidental  ignition  of 
a  fire  by  a  passenger  in  the  passenger  compartment.  The  description  is  of  an 
event  involving  lighter  fluid,  but  it  could  have  been  pressurized  hair  spray,  a 
butane  lighter  or  lighted  smoking  material. 

The  ACES  system  in  its  basic  form  would  not  include  sensors  in  the  passenger 
compartment:  the  crew  and  passengers  present  in  the  compartment  constitute  a 
sensing  and  severity  evaluation  system  at  least  equal  to  (or  perhaps  even  faster 
than)  the  projected  ACES  hardware.  It  is  within  the  overall  ACES  concept, 
however,  to  process  and  respond  to  this  human  sensor  input  in  much  the  same 
way  that  automatic  sensing  is  dealt  with.  The  human-sensed  information  could 
be  entered  manually  and  the  ACES  would  supply  all  of  the  appropriate 
emergency  procedures  and  would  have  reset  its  own  sensing  system  in 
recognition  of  the  on-board  fire. 

In  this  incident  the  rapid  detection  and  diagnosis  that  is  critical  for  most 
in-flight  fires  is  of  lesser  importance  than  the  support  ACES  provides  in 
emergency  procedures  and  the  change  in  sensitivity  of  the  entire  ACES  system. 
This  incident  was  quickly  defeated  and  the  consequences  were  not  serious.  A 
similar  situation  could  be  imagined  in  which  the  support  from  the  ACES  system 
would  have  been  a  more  critical  input. 
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TABLE  13.  SCENARIO  13  -  TIMELINE  SUMMARY 
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FLIGHT  FIIASK  Cruise  Cruise  Cruise  Descent  Descent  Descent  Landing 


CONCLUSIONS 


The  purpose  of  this  study  was  to  conduct  a  technology  assessment  to  determine 
whether  the  feasibility  exists  for  the  FAA  to  support  the  development  of  a 
computer-based  cockpit  system  to  assist  aircraft  command  in  emergency 
situations  (ACES).  The  several  analyses  that  were  conducted  in  this  study 
highlighted  numerous  benefits  arising  from  the  use  of  an  ACES  system  which 
lead  directly  to  the  conclusion  that  an  ACES  is  both  feasible  and  a  desirable 
addition  to  commercial  transports. 

The  activities  of  the  present  study  were  structured  around  answering  four 
questions  posed  by  the  Statement  of  Work.  The  specific  conclusions  with 
respect  to  each  of  these  questions  will  now  be  presented  followed  by  a 
discussion  of  considerations  related  to  the  implementation  of  an  ACES. 

WHAT  INFORMATION  IS  NEEDED  TO  LOCATE  AND  MONITOR  FIRE  AND  SMOKE 
SOURCES? 


The  circumstances  surrounding  the  handling  of  in-flight  fire  and  smoke  events 
were  examined  as  a  four  step  process — detection,  localization,  identification  and 
evaluation/ action.  The  analysis  of  actual  incidents  led  to  the  conclusion  that 
the  major  difficulties  in  actual  fire  events  were  primarily  in  the  first  three 
processes.  Fires  often  went  undetected  until  they  had  had  time  to  grow  and 
spread  significantly.  Even  when  initial  detection  evidence  was  available  from 
sensors  or  human  observation,  localization  of  the  fire's  source  and  identification 
of  the  severity  of  the  incident  were  often  delayed  or  inaccurate.  The  failure  of 
the  flight  crew  to  assess  correctly  the  type  and  severity  of  a  fire/  smoke  event 
was  a  major  factor  in  the  observed  delays  in  taking  appropriate  action.  These 
delays  resulted  in  less  available  time  in  which  to  make  a  safe  landing. 

The  key  to  successful  management  of  in-flight  fire  and  smoke  events  is  the 
detection  of  the  fire  early  in  its  development.  The  essential  information  can  be 
derived  from  remote  sensors  which  produce  analog  outputs.  These  outputs, 
when  monitored  by  an  "intelligent"  computer  program,  can  yield  trend 
information  which  permits  both  the  early  detection  of  a  fire  and  the 
discrimination  of  real  from  false  events.  It  is  concluded  that  sensor  batteries 
of  co-located  aerosol  (smoke)  and  temperature  (heat)  sensors  will  provide  the 
best  information. 

This  study  identified  many  candidate  locations  in  which  sensors  could  be  placed 
within  the  fuselage  of  a  transport  aircraft.  The  scenario-based  analysis  of  the 
ACES  permitted  these  areas  to  be  classified  according  to  their  priority  for 
sensor  installation.  The  areas  with  the  highest  priority,  i.e.,  those  in  which  it 
is  concluded  that  sensors  should  be  installed  include  the  following  four  areas. 
These  areas  contain  sensors  of  some  kind  in  most  existing  aircraft. 

CARGO  COMPARTMENTS.  The  inaccessibility  of  the  cargo  holds,  the  variety  of 
combustibles  they  can  contain  and  the  problems  experienced  in  cargo  areas 
indicate  the  need  for  a  battery  of  heat  and  smoke  sensors. 

LAVATORIES.  The  relatively  high  frequency  of  fire  incidents  in  lavatories 
suggests  the  need  for  a  sensor  battery  installation. 
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AVIONICS  BAY.  The  criticality  of  the  components  housed  in  the  avionics  bay 
necessitates  a  maximum  protection  approach.  Hence,  a  heat  and  smoke  battery 
of  detectors  appears  warranted.  This  reasoning  also  applies  to  the  areas 
behind  the  instrument  panel  in  the  cockpit. 

LOWER  LOBE  GALLEYS.  Galleys  located  below  the  passenger  deck  are  similar 
in  nature  to  cargo  holds.  Even  though  occupied  for  some  of  the  time  during  a 
flight,  these  galleys  should  be  considered  high  risk  areas  given  the  numerous 
combustion  sources  and  relatively  poor  accessibility. 

A  second  group  of  areas  within  the  fuselage  is  characterized  by  a  moderate 
problem  potential.  These  areas  may  be  candidates  for  the  installation  of 
sensors  if  cost/benefit  analyses  indicated  they  were  warranted.  Locations 
included  in  this  group  are: 

CHEEK  AND  '  TTIC.The  potential  for  combustion  in  cheek  and  attic  areas  would 
suggest  the  need  for  remote  sensing  of  some  type.  Continuous  filament  (line- 
type)  heat  sensors  may  be  the  best  approach  for  cheeks  and  unoccupied  attic 
spaces.  Both  smoke  and  heat  sensors  appear  to  be  necessary  in  those  attic 
spaces  to  be  used  as  crew  rest  areas.  The  extremely  large  volume  in  cheeks 
and  attics  suggests  a  need  for  sensors,  but  cost/benefit  analyses  should  be 
done. 

MAIN  DECK  GALLEYS.  These  galleys  are  the  most  frequently  reported  site  of 
fire /smoke  incidents.  Even  though  many  of  these  are  of  limited  severity,  the 
total  frequency  suggests  a  study  of  the  use  of  ACES  sensors.  In  such  a 
study,  the  accessibility  of  these  galleys  to  human  sensing  must  be  considered. 
By  way  of  comparison,  the  rapid  response  and  resistance  to  false  alarms 
inherent  in  the  ACES  intelligent  sensors  must  also  be  considered.  A  practical 
and  cost-effective  implementation  can  be  achieved. 

APU  AND  AIR  CONDITIONING  PACKS.  These  units  are  already  monitored  in 
some  manner.  The  trade-offs  associated  with  upgrading  their  sensors  to  the 
ACES  level  of  sophistication  would  have  to  be  examined. 

CLOSETS  AND  STORAGE  BINS.  Closets  and  storage  bins  within  the  passenger 
cabin  can  contain  a  variety  of  flammables.  Fires  within  these  compartments  can 
grow  undetected  even  though  many  human  "sensors"  are  nearby.  The  absence 
of  incidents  would  argue  against  sensing,  but  the  potential  for  passenger 
involvement  and  the  proximity  of  passenger  service  centers  would  suggest 
consideration  of  detector  installation.  Again,  an  analysis  of  cost  and  overrdl 
benefit  is  needed. 

The  third  group  of  locations  would  appear  not  to  warrant  sensor  installation. 
This  group  includes: 

COCKPIT  OPEN  AREAS.  The  continual  presence  of  a  crew  member  in  the 
cockpit's  open  areas  greatly  reduces  the  need  for  sensors. 

PASSENGER  CABINS.  The  technical  problems  involved  in  remote  sensing  of  the 
passenger  cabin  appear  to  outweigh  any  potential  benefits.  The  passengers  and 
crew  can  provide  sufficient  early  warning. 

In  addition  to  sensor  information  and  alerting  by  crew  and  passengers,  it  is 
concluded  that  "circumstantial"  evidence  can  also  be  used  productively  to 
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enhance  the  effectiveness  of  an  ACES  system.  This  information  would  include 
data  on  flight  dynamics,  circuit  breaker  status  and  electrical  and  hydraulic 
loads . 

IS  THE  SENSING  CAPABILITY  AVAILABLE  OR  ATTAINABLE? 

All  of  the  information  identified  by  this  study  as  having  potential  utility  for  an 
ACES  system  is  well  within  the  state-of-the-art.  Smoke  and  heat  sensors  using 
existing  technology  can  be  engineered  to  produce  the  analog  outputs  required 
by  the  ACES  configuration.  The  "circumstantial"  data  are  readily  available  on 
the  present  and  contemplated  aircraft  digital  data  buses.  It  is  therefore  the 
conclusion  of  the  present  study  that  the  input  information  needed  to  support  an 
ACES  system  for  the  management  of  in-flight  fires  is  available  or  easily 
obtainable  and  is  not  a  limiting  factor  in  either  the  development  or  deployment 
of  an  ACES. 

WHAT  COURSE  OF  ACTION  CAN  BE  EMPLOYED  IN  REACTION  TO  THE  SENSED 
INFORMATION? 


The  ACES  configuration  assessed  by  this  study  uses  sensed  information  as 
input  to  an  expert  system  which  supports  decision-making.  The  software 
attempts  to  discriminate  real  from  false  alarms,  localize  the  fire  or  smoke  and 
identify  the  severity  of  the  incident.  It  also  activates  appropriate  warnings  for 
the  crew  and  presents  them  with  information  upon  which  to  select  and  deploy 
countermeasures . 

The  analysis  of  the  in-flight  fire  problem  led  to  the  conclusion  that  the  current 
major  sources  of  difficulty  were  fire  detection,  localization  and  identification. 
There  were  also  problems  in  locating  and  retrieving  procedural  checklists. 
Once  these  steps  were  successfully  performed,  the  indicated  course  of  action  in 
all  cases  of  confirmed  or  possible  fire  or  smoke  incidents  was  to  terminate  the 
flight  at  the  nearest  suitable  airport,  deploy  suppression  efforts  if  available, 
and  execute  smoke  elimination  procedures  if  warranted.  The  analytic  results  as 
well  as  the  opinions  of  the  airline  and  airframe  companies  contacted  suggested 
no  other  response  to  an  in-flight  fire  than  an  immediate  landing.  The  results 
also  did  not  uncover  any  significant  problems  with  the  prescribed  emergency 
checklist  procedures  even  though  some  difficulty  in  locating  and  using  them 
contributed  to  the  severity  of  some  in-flight  fire  incidents. 

It  is  concluded  that  an  ACES  system  design  effort  should  focus  on  the  rapid 
detection  of  fires,  the  discrimination  of  real  from  false  alarms  and  the  promotion 
of  correct  and  timely  decision-making  by  the  flight  crew.  The  essential 
response  in  the  case  of  an  ACES-confirmed  fire,  or  the  inability  of  the  ACES  to 
resolve  the  available  information  within  a  reasonable  time  is  the  immediate,  safe 
termination  of  the  flight. 

When  the  ACES  is  able  to  determine  that  the  condition  sensed  is  a  sensor 
failure,  the  ACES  should  have  the  capacity  to  alert  the  crew  and  reconfigure  to 
continue  sensing  without  the  failed  unit.  The  operating  policies  of  the 
individual  airlines  should  then  dictate  the  specific  system  response  which  could 
range  from  terminating  the  flight  to  holding  the  entire  failure  and 
reconfiguration  transparent  to  the  crew. 
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The  consideration  of  reaction  to  sensed  information  must  also  be  concerned  with 
flight  crew  workload  in  two  ways.  First,  the  workload  level  at  the  time  the 
ACES  presents  the  information  must  be  assessed.  This  level  will  determine  the 
ability  of  the  crew  to  react  to  the  ACES  warning.  It  is,  in  essence,  a  queuing 
theory  approach  to  pilot  workload  and  addresses  the  capacity  of  the  crew  to 
deal  with  the  next  task  presented,  i.e.,  the  ACES  warning. 

Second,  a  potentially  relevant  aspect  of  workload  is  the  incremental  workload 
presented  by  the  ACES  stimulus.  In  addition  to  responding  to  the  ACES 
information,  the  crew  must  fly  the  aircraft  and  manage  any  other  problems 
which  have  arisen.  Even  if  the  ACES  presents  important  information  in  a  timely 
manner,  it  may  be  ineffective  if  it  creates  an  overload  situation. 

Theoretically,  workload  is  an  issue  of  concern  with  respect  to  an  ACES  system. 
Clearly,  care  must  be  exercised  in  any  future  ACES  design  effort  to  insure  that 
the  ACES  configuration  is  compatible  with  the  total  set  of  tasks  the  crew  might 
be  called  upon  to  perform  at  the  time  an  ACES  warning  is  generated.  Within 
the  context  of  the  present  study,  however,  it  was  concluded  that  excessive 
workload  was  neither  a  major  part  of  the  identified  problem  of  in-flight  fires 
nor  a  significant  factor  in  determining  the  feasibility  of  an  ACES  system. 

The  conclusion  that  crew  workload  is  not  a  major  concern  for  ACES  arises  from 
a  careful  review  of  the  actual  in-flight  fire  incidents  collected  for  this  study. 
To  be  sure,  excessive  levels  of  workload  were  experienced  during  these 
incidents.  However,  the  origins  of  this  workload  were  generally  errors  by  the 
crews  in  interpreting  signs  of  the  fire  and  problems  in  locating  and  accessing 
the  correct  procedural  checklists.  For  example,  in  Scenarios  1  and  12,  flight 
crew  workload  reached  excessive  levels  because  the  crew  unreasonably  delayed 
accepting  and  responding  to  the  signs  of  fire  which  had  been  accurately 
presented.  These  delays  allowed  the  fires  to  reach  a  level  of  seriousness  which 
would  not  have  been  experienced  while  the  aircraft  was  still  airborne  if  the 
crew  had  diverted  to  the  nearest  suitable  airport  at  the  first  indication  of  a 
problem. 

The  ACES  as  configured  for  this  study  was  designed  to  reduce  crew  workload 
by  collecting  and  analyzing  data  and  applying  expert  rules  without  the 
intervention  of  the  crew.  It  is  also  intended  to  present  appropriate  checklists 
and  status  displays  automatically,  thereby  further  reducing  the  effort  required 
of  the  crew.  These  benefits,  however,  can  only  be  fully  realized  if  the  crew 
has  faith  in  the  ACES  and  responds  confidently  and  swiftly  to  its  warnings.  It 
is  reasonable  to  conclude  that  the  required  trust  will  be  achieved  if  an  ACES 
implementation  is  accomplished  with  a  level  of  reliability  that  is  consistent  with 
other  well  accepted  avionics  systems. 

WITHIN  CONSTRAINTS  OF  ANTICIPATED  COCKPIT  TECHNOLOGY  FOR  FUTURE 
COMMERCIAL  TRANSPORT  AIRCRAFT,  CAN  THIS  INFORMATION  BE 
COMPU1 ERIZED  AND  RETRIEVED  IN  A  FAIL-SAFE  OR  FAIL-OPERATIONAL 
MANNER? 

There  is  virtually  no  doubt  that  anticipated  cockpit  technology  for  future  large 
transport  aircraft  can  support  an  ACES  as  envisioned  by  this  study.  The 
industry  plans  for  increased  use  of  digital  data  buses  and  integrated  avionics 
processors  running  compiled  programs  written  in  the  Ada  language  provide  an 
ideal  setting  for  the  installation  of  an  ACES.  Moreover,  there  would  appear  to 


120 


be  more  than  adequate  processor  capacity  to  support  an  ACES  system  operating' 
at  an  efficient  rate  of  information  updating. 

It  is  also  concluded  that  an  ACES  can  be  easily  and  productively  integrated  into 
the  existing  master  warning  concept  for  crew  alerting.  The  present  "glass 
cockpit"  includes  two  displays  for  monitoring  all  aircraft  systems  and  the 
associated  computational  support.  This  provides  an  appropriate  interface 
between  the  crew  and  an  ACES  system.  Thus,  cockpit  hardware  changes  with 
respect  to  information  retrieval  from  an  ACES  should  not  represent  an  obstacle 
to  further  ACES  system  development. 

The  types  of  input  information  required  for  an  ACES  processor  to  reach 
"intelligent"  decisions  in  a  reliable  manner  are  typically  available  on  the  current 
generation  of  transports.  Engineering  sensors  to  produce  an  analog  output  so 
that  heat  and  smoke  level  can  be  tracked  over  time  is  not  a  problem.  The 
accurate  transmission  of  the  sensor  data  and  any  other  inputs  required  by  the 
ACES  processing  algorithms  is  assured  by  the  inherently  robust  design  of 
digital  data  buses  structured  according  to  ARINC  specifications. 

Perhaps  the  greatest  potential  source  of  low  reliability  for  an  ACES  system 
would  be  the  decision  rules  implemented  in  the  software.  If  these  rules  are  not 
carefully  designed,  excessive  false  alarms  or  unwarranted  delays  in  issuing  a 
warning  could  result.  The  types  of  algorithms  required  are  primarily  trend 
detection  for  determining  positive  slope,  pattern  recognition  for  detecting  fire 
signatures  and  failed  sensors,  and  Boolean  logic  to  deduce  a  fire  situation  from 
a  variety  of  input  signals.  Each  of  these  types  of  decision  rules  has  been 
extensively  studied  and  used  in  systems  analogous  to  an  ACES.  It  is  therefore 
reasonable  to  conclude  that  software  can  be  written  to  achieve  greatly  improved 
in-flight  fire  management  performance.  Further,  virtually  fail-safe  operation 
can  be  achieved  by  built-in  diagnostic  routines  and  the  adoption  of  conservative 
responses  to  ACES  alerts  and  alarms. 

IMPLEMENTATION. 

The  conclusion  that  an  ACES  is  feasible  and  well  within  the  state-of-the-art 
leads  to  the  additional  finding  that  a  detailed  design  effort  is  warranted.  This 
design  study  would  have  to  address  the  microscopic  issues  highlighted  by  the 
present  effort.  In  order  to  yield  the  best  possible  design,  it  is  believed  that 
the  next  effort  should  be  multi-disciplinary  in  nature  and  cover  at  least: 

SENSOR  TECHNOLOGY.  A  careful  examination  of  the  alternative  aerosol  and 
temperature  sensors  capable  of  producing  analog  outputs  is  needed.  Both  spot 
and  line-type  sensors  should  be  covered.  Sensor  response  patterns,  reliability, 
maintainability  and  cost  should  be  considered. 

FIRE  SIGNATURES.  Signatures  for  the  most  likely  in-flight  fire  events  have  to 
be  identified  from  experimental  input.  These  signatures  should  focus  on  the 
patterns  produced  by  each  type  of  fire  on  the  designated  types  of  sensors. 

AMBIENT  SIGNATURES.  In  order  to  function  effectively,  the  ACES  must  be 
able  to  distinguish  real  fire  signatures  from  the  variety  of  ambient  conditions 
likely  to  be  experienced  during  transport  operations.  The  best  way  to 
accomplish  this  is  to  build  a  normative  data  base  of  the  ambient  conditions  and 


121 


the  situations  which  produce  them.  This  data  base  could  be  produced  by 
installing  sensor  batteries  in  line  aircraft  and  monitoring  their  outputs  over  an 
extended  range  of  flying  conditions.  These  data  could  be  augmented  by 
controlled  experiments  with  actual  aircraft  to  simulate  conditions  of  interest 
which  were  not  experienced  during  the  on-line  data  collection. 

FMEA/CIL  AND  HAZARD  ANALYSES.  A  failure  modes  and  effects  analysis 
(FMEA)  and  a  critical  incident  list  (CIL)  should  be  prepared  for  a 
representative  set  of  aircraft  types.  These  analyses  will  support  a 
detailed  fire  hazard  analysis  which  will  identify  and  quantify  the  specific 
threats  the  ACES  must  be  designed  to  address. 

ALGORITHM  DEVELOPMENT.  Statistical  and  logical  decision  rules  must  be 
developed  based  on  the  detailed  FMEA/CIL  analyses  and  the  hazard  analysis. 
These  will  be  used  as  input  to  software  development. 

HUMAN  FACTORS  ANALYSIS.  The  detailed  system  design  would  have  to  be 
guided  by  an  allocation  of  functions  between  the  processors  and  the  crew. 
This  allocation  would  arise  from  a  human  factors  analysis.  Among  the  issues  to 
be  addressed  would  be  when  and  how  to  alert  the  crew  and  when  to  keep  the 
activities  of  the  ACES  transparent.  Detailed  design  specifications  for  the 
content  of  any  warning  messages  to  be  displayed  would  also  be  needed. 
Further,  the  cost-effectiveness  of  a  "line  select"  function  to  permit  the  crew  to 
accomplish  checklist  items  automatically  by  acknowledging  an  ACES  request  to 
take  action  should  be  explored. 

SOFTWARE  DEVELOPMENT.  The  identified  algorithms  and  warning  displays 
would  have  to  be  implemented  in  Ada  code  to  run  on  the  new  32  bit  avionics 
processors.  Associated  software  for  transmitting  sensor  signals  on  the  digital 
data  bus  and  retrieving  non-sensor  data  from  the  bus  would  also  be  required. 

As  part  of  this  study,  individuals  in  the  aircraft  and  airline  industry  were 
contacted  and  exposed  to  the  concept  of  an  ACES.  The  assistance  given  by 
these  individuals  and  organizations  as  well  as  their  strong  expression  of 
interest  suggest  that  a  properly  designed  and  reasonably  priced  ACES  system 
for  new  aircraft  would  be  positively  received.  There  also  appeared  to  be  a 
strong  sentiment  that  the  introduction  of  an  ACES  system  would  be  facilitated  if 
the  FAA  or  other  governmental  agency  funded  the  required  developmental 
research  and  promoted  the  system  as  a  cooperative  government/industry 
program  rather  than  as  an  airworthiness  regulation. 

Finally,  the  efforts  surrounding  the  present  study  led  to  a  conclusion  which 
relates  to  aviation  fire  safety  in  general  as  well  as  to  ACES  implementation. 
Many  of  the  actual  in-flight  fire  incidents  examined  involved  an  apparent  lack  o 
appreciation  by  the  crew  of  the  fire  generation  process  and  of  the  potential 
hazard  of  even  a  limited  in-flight  fire.  This  was  manifested  in  protracted 
attempts  to  confirm  the  existence  of  a  fire  or  to  suppress  it  before  taking 
immediate  steps  to  terminate  the  flight.  At  the  outbreak  of  a  fire ,  flight  crew 
behavior  appears  to  be  analogous  to  the  typical  homeowner  who  stays  behind  to 
fight  a  blaze  which  is  already  out  of  control  or  to  retrieve  personal  belongings. 
This  behavior  can  most  probably  be  attributed  to  knowledge  deficiencies 
concerning  fire  safety.  It  is  therefore  not  unreasonable  to  conclude  that  some 
of  the  incorrect  decision-making  by  flight  crews  arises  from  the  same  inadequate 
knowledge  about  fires. 
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In  order  to  insure  the  maximum  effectiveness  for  an  ACES  and,  in  fact,  for 
aviation  fire  safety  in  general,  enhanced  training  of  flight  and  cabin  crews  in 
the  fire  generation  process  should  be  explored.  This  would  augment  existing 
efforts  which  are  focused  primarily  at  fire  suppression  activities.  The 
additional  understanding  promoted  by  training  of  this  type  would  provide  the 
background  needed  to  establish  appropriate  priorities  after  a  fire  is  detected. 
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